PT-2026-1210 · Bg5Sbk · Minicms

Blackooo · Published 2026-01-05 · Updated 2026-01-10 · CVE-2025-15456

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions bg5sbk MiniCMS versions up to 1.8

Description A flaw exists in bg5sbk MiniCMS that allows for improper authentication. This issue affects the Publish Page Handler component, specifically an unknown function within the /mc-admin/page-edit.php file. The attack can be carried out remotely. The exploit for this issue has been publicly disclosed. The existence of this issue is currently disputed. The vendor was notified but did not respond.

Recommendations Versions prior to 1.8 should be updated. As a temporary workaround, restrict access to the /mc-admin/page-edit.php file to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-15456

Affected Products

Minicms

References · 12

• 🔥 https://github.com/ueh1013/VULN/issues/13 · Exploit
• https://osv.dev/vulnerability/CVE-2025-15456 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15456 · Security Note
• https://twitter.com/cracbot/status/2009943347797139665 · Twitter Post
• https://twitter.com/cracbot/status/2009218581826031619 · Twitter Post
• https://twitter.com/CVEnew/status/2008036392354394440 · Twitter Post
• https://vuldb.com/?id.339489 · Note
• https://t.me/CVEtracker/41345 · Telegram Post
• https://vuldb.com/?submit.725138 · Note
• https://t.me/cveNotify/147672 · Telegram Post
• https://vuldb.com/?ctiid.339489 · Note
• https://twitter.com/VulmonFeeds/status/2008054237700239867 · Twitter Post