Vulnerabilities

TI-2025-14099 CVE-2025-15458 · GHSA-3rg8-47q7-qh6r

bg5sbk MiniCMS Article post-edit.php improper authentication

HIGH 70

A vulnerability was determined in bg5sbk MiniCMS up to 1.8.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00574 Published 2026-01-05 No fix listed CWE-287

TI-2025-14098 CVE-2025-15457 · GHSA-q273-h833-fw3m

bg5sbk MiniCMS Trash File Restore post.php improper authentication

HIGH 70

A vulnerability was found in bg5sbk MiniCMS up to 1.8.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00574 Published 2026-01-05 No fix listed CWE-287

TI-2025-14097 CVE-2025-15456 · GHSA-p6hr-wcj3-8rqw

bg5sbk MiniCMS Publish page-edit.php improper authentication

HIGH 70

A vulnerability has been found in bg5sbk MiniCMS up to 1.8.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00439 Published 2026-01-05 No fix listed CWE-287

TI-2025-14096 CVE-2025-15455 · GHSA-c6qr-xj7q-ppxr

bg5sbk MiniCMS File Recovery Request page.php delete_page improper authentication

HIGH 70

A flaw has been found in bg5sbk MiniCMS up to 1.8.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00692 Published 2026-01-05 No fix listed CWE-287

TI-2024-08616 CVE-2024-9282 · GHSA-75j3-hvj5-22vw

bg5sbk MiniCMS page-edit.php cross-site request forgery

MEDIUM 64

A vulnerability was found in bg5sbk MiniCMS 1.11.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00317 Published 2024-09-27 No fix listed CWE-352

TI-2024-08615 CVE-2024-9281 · GHSA-8q9m-g5j8-h6qr

bg5sbk MiniCMS post-edit.php cross-site request forgery

MEDIUM 64

A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00356 Published 2024-09-27 No fix listed CWE-352

TI-2024-20917 CVE-2024-31741 · GHSA-vpw3-jjp6-wh95

Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run…

MEDIUM 60

Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00373 Published 2024-04-26 No fix listed CWE-79

TI-2023-24967 CVE-2023-46378 · GHSA-qxv7-837m-ggxx

Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run…

MEDIUM 58

Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00447 Published 2023-10-31 No fix listed CWE-79

TI-2021-12833 CVE-2021-33387 · GHSA-fgww-cpj8-mmj9

Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary…

HIGH 76

Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00838 Published 2023-02-24 No fix listed CWE-79

TI-2020-13735 CVE-2020-19896 · GHSA-jjw7-pxf7-x56f

File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.

MEDIUM 45

File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01567 Published 2022-06-28 No fix listed

TI-2022-14572 CVE-2022-33121 · GHSA-j6vr-xhr9-3vq4

A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily…

LOW 35

A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0041 Published 2022-06-24 No fix listed CWE-352

TI-2021-18365 CVE-2021-41663 · GHSA-x4gv-4jg3-4vr6

A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11.

LOW 29

A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00785 Published 2022-06-13 No fix listed CWE-79

TI-2021-20356 CVE-2021-44970 · GHSA-4w2g-r9pq-p6qg

MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.

LOW 25

MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00487 Published 2022-02-10 No fix listed CWE-79

TI-2020-13295 CVE-2020-17999 · GHSA-7xp7-6fc7-c4j6

Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary…

LOW 30

Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01605 Published 2021-04-28 No fix listed CWE-79

TI-2020-18429 CVE-2020-36051 · GHSA-cx82-xv8x-vcx3

Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote…

LOW 37

Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01996 Published 2021-01-05 No fix listed CWE-22

TI-2020-18430 CVE-2020-36052 · GHSA-287f-5vcq-p94w

Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote…

MEDIUM 46

Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01927 Published 2021-01-05 No fix listed CWE-22

TI-2019-10023 CVE-2019-13341 · GHSA-63j5-8pmx-775r

In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.

LOW 23

In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0061 Published 2019-07-05 No fix listed CWE-79

TI-2019-10022 CVE-2019-13340 · GHSA-4jqp-jwwp-p9cj

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box.

LOW 23

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0061 Published 2019-07-05 No fix listed CWE-79

TI-2019-10021 CVE-2019-13339 · GHSA-7rph-jm7x-6cp2

In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can…

LOW 23

In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00619 Published 2019-07-05 No fix listed CWE-79

TI-2019-09879 CVE-2019-13186 · GHSA-7gmj-cj42-m563

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box.

LOW 29

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00865 Published 2019-07-03 No fix listed CWE-79

TI-2019-07020 CVE-2019-9603 · GHSA-j594-cx5f-577c

MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a…

LOW 29

MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00506 Published 2019-03-06 No fix listed CWE-352

TI-2018-14550 CVE-2018-20520 · GHSA-2929-2p92-7c6j

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.

LOW 29

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00865 Published 2018-12-27 No fix listed CWE-79

TI-2018-13388 CVE-2018-18892 · GHSA-pc8h-5qfp-98rq

MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename…

MEDIUM 47

MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0258 Published 2018-11-01 No fix listed CWE-94

TI-2018-13387 CVE-2018-18891 · GHSA-565w-qhx8-388r

MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the…

LOW 35

MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01175 Published 2018-11-01 No fix listed CWE-287

TI-2018-13386 CVE-2018-18890 · GHSA-2pv6-5vvf-vv7f

MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename.

LOW 27

MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01495 Published 2018-11-01 No fix listed CWE-22

Vulnerabilities

Filters