PT-2026-1209 · Bg5Sbk · Minicms

Blackooo · Publicado 2026-01-05 · Atualizado 2026-01-21 · CVE-2025-15455

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions bg5sbk MiniCMS versions up to 1.8

Description A flaw exists in bg5sbk MiniCMS up to version 1.8 related to improper authentication. The issue is located in the delete page function within the /minicms/mc-admin/page.php file of the File Recovery Request Handler component. This manipulation allows for remote exploitation. The exploit has been published. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 1.8 should be updated. As a temporary workaround, consider restricting access to the /minicms/mc-admin/page.php file.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2025-15455

Produtos afetados

Minicms

Referências · 11

• 🔥 https://github.com/ueh1013/VULN/issues/14 · Exploit
• https://t.me/cveNotify/149482 · Publicação no Telegram
• https://t.me/cveNotify/147671 · Publicação no Telegram
• https://vuldb.com/?id.339488 · Nota
• https://twitter.com/CVEnew/status/2008036393281368330 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-15455 · Nota de Segurança
• https://vuldb.com/?submit.725137 · Nota
• https://vuldb.com/?ctiid.339488 · Nota
• https://twitter.com/VulmonFeeds/status/2008033745832476903 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-15455 · Aviso do Fabricante
• https://t.me/CVEtracker/41344 · Publicação no Telegram