CVE-2025-15458 is a high severity improper authentication flaw (CVSS 7.3) in bg5sbk MiniCMS up to 1.8. The article handler in mc-admin/post-edit.php can be used without proper authentication, and an exploit is public per the record. The vendor did not respond and no fix is confirmed.
What's affected
The record lists bg5sbk MiniCMS up to 1.8. The affected file is /mc-admin/post-edit.php, the component the record calls the Article Handler. The flaw is improper authentication, so the edit action does not properly check who is calling it.
It sits beside CVE-2025-15457, which covers the trash restore handler in post.php. Two admin scripts without proper checks suggest the product's admin area should be treated as untrusted as a whole.
No fixed release is named in the record or in the public report I fetched, and the vendor did not respond.
How to check if you're exposed
Locate installs, then check the admin area from outside:
find / -name "post-edit.php" -path "*mc-admin*" 2>/dev/null
From a browser with no session, request your site's mc-admin pages. Any page that loads without asking for a login is exposed. In the access log, search for POST requests to post-edit.php and match them against your own admin sessions. Anything from an unfamiliar address deserves a closer look at the article it touched.
Compare current articles against a backup to find changes you did not make.
What to do now
- Find all MiniCMS installs and their versions, and treat 1.8 and earlier as affected.
- Restrict
mc-adminat the web server to known addresses or put HTTP authentication in front of it. - Compare published posts against a backup to find unauthorized edits, including injected links or scripts.
- Reset admin credentials and review server file changes since the disclosure.
- Move to a CMS that still gets security fixes.
Why it matters
This is CWE-287, Improper Authentication. An edit script that does not verify the session lets an outsider change posts directly. Injected links and scripts in articles are a favored result because they reach every visitor and are easy to miss.
The vector is network based, needs no privileges, and shows low impact on each of confidentiality, integrity and availability (7.3). The record does not list it in CISA's Known Exploited Vulnerabilities catalog, and it makes no claim of attacks in the wild beyond the public disclosure.
Quick check
How do I know whether my posts were altered?
Compare them with a backup, and check access logs for post requests to post-edit.php from addresses that are not yours.
Does it matter that two CVEs exist for MiniCMS?
Yes. Each covers a different script, so treat the whole mc-admin directory as exposed rather than patching or blocking a single file.
Sources
Last reviewed: 19 October 2026.
