CVE-2025-15458

CVE-2025-15458 is an improper authentication vulnerability (CWE-287) in bg5sbk MiniCMS versions up to 1.8. The issue resides in an unknown function within the file /mc-admin/post-edit.php of the Article Handler component. It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites for exploitation.

The vulnerability can be exploited remotely by unauthenticated attackers with no privileges required. Successful manipulation bypasses authentication controls, potentially granting unauthorized access to administrative functions related to article editing. This could enable attackers to modify, delete, or create content within the CMS, with low-level impacts on confidentiality, integrity, and availability.

Advisories from VulDB and a GitHub issue in ueh1013/VULN detail the vulnerability but provide no information on patches or vendor-supplied mitigations, as the vendor was contacted early for disclosure coordination yet did not respond. Security practitioners should isolate or decommission affected MiniCMS instances and monitor for exploitation attempts targeting the /mc-admin/post-edit.php endpoint.

The exploit has been publicly disclosed via the referenced GitHub issue and VulDB entries, making it readily available for use by threat actors. No evidence of active in-the-wild exploitation is noted in available sources.