PT-2026-1209 · Bg5Sbk · Minicms

Blackooo · Published 2026-01-05 · Updated 2026-01-21 · CVE-2025-15455

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions bg5sbk MiniCMS versions up to 1.8

Description A flaw exists in bg5sbk MiniCMS up to version 1.8 related to improper authentication. The issue is located in the delete page function within the /minicms/mc-admin/page.php file of the File Recovery Request Handler component. This manipulation allows for remote exploitation. The exploit has been published. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 1.8 should be updated. As a temporary workaround, consider restricting access to the /minicms/mc-admin/page.php file.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-15455

Affected Products

Minicms

References · 11

• 🔥 https://github.com/ueh1013/VULN/issues/14 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15455 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15455 · Vendor Advisory
• https://t.me/cveNotify/149482 · Telegram Post
• https://t.me/cveNotify/147671 · Telegram Post
• https://vuldb.com/?id.339488 · Note
• https://twitter.com/CVEnew/status/2008036393281368330 · Twitter Post
• https://vuldb.com/?submit.725137 · Note
• https://vuldb.com/?ctiid.339488 · Note
• https://twitter.com/VulmonFeeds/status/2008033745832476903 · Twitter Post
• https://t.me/CVEtracker/41344 · Telegram Post