Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
36 results
Jan 5, 2026A vulnerability was determined in bg5sbk MiniCMS up to 1.8.CVE-2025-15458 · Other software · bg5sbk · reported by VulDBMedium 5.5
A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the component Article Handler. Executing a manipulation can lead to improper authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MiniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026A vulnerability was found in bg5sbk MiniCMS up to 1.8.CVE-2025-15457 · Other software · bg5sbk · reported by VulDBMedium 5.5
A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Trash File Restore Handler. Performing a manipulation results in improper authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MiniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2026A vulnerability has been found in bg5sbk MiniCMS up to 1.8.CVE-2025-15456 · Other software · bg5sbk · reported by VulDBMedium 5.5
A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php of the component Publish Page Handler. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The existence of this vulnerability is still disputed at present. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MiniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2026A flaw has been found in bg5sbk MiniCMS up to 1.8.CVE-2025-15455 · Other software · bg5sbk · reported by VulDBMedium 5.5
A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery Request Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MiniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024A vulnerability was found in bg5sbk MiniCMS 1.11.CVE-2024-9282 · Other software · bg5sbk · reported by VulDBMedium 6.9
A vulnerability was found in bg5sbk MiniCMS 1.11. It has been classified as problematic. Affected is an unknown function of the file page-edit.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MiniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic.CVE-2024-9281 · Other software · bg5sbk · reported by VulDBMedium 6.9
A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MiniCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2024Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login.CVE-2024-31741 · Other software · minicms_project · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login.
- Product
- minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.CVE-2023-46378 · Other software · 1234n · reported by MITREMedium 5.4
Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.CVE-2021-33387 · Other software · 1234n · reported by MITRECritical 9.6
Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.CVE-2020-19896 · Other software · 1234n · reported by MITRECritical 9.8
File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.CVE-2022-33121 · Other software · 1234n · reported by MITREHigh 8.1
A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11.CVE-2021-41663 · Other software · 1234n · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.CVE-2021-44970 · Other software · 1234n · reported by MITREMedium 5.4
MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component CVE-2020-17999 · Other software · 1234n · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2021Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter.CVE-2020-36052 · Other software · 1234n · reported by MITRECritical 9.8
Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2021Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.CVE-2020-36051 · Other software · 1234n · reported by MITREHigh 7.5
Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2019In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.CVE-2019-13341 · Other software · 1234n · reported by MITREMedium 4.8
In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2019In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box.CVE-2019-13340 · Other software · 1234n · reported by MITREMedium 4.8
In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2019In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.CVE-2019-13339 · Other software · 1234n · reported by MITREMedium 4.8
In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2019In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box.CVE-2019-13186 · Other software · 1234n · reported by MITREMedium 6.1
In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2019MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.CVE-2019-9603 · Other software · 1234n · reported by MITREMedium 6.5
MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2018MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.CVE-2018-20520 · Other software · 1234n · reported by MITREMedium 6.1
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2018MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.CVE-2018-18892 · Other software · 1234n · reported by MITRECritical 9.8
MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2018MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.CVE-2018-18891 · Other software · 1234n · reported by MITREHigh 7.5
MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2018MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename.CVE-2018-18890 · Other software · 1234n · reported by MITREMedium 5.3
MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2018MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.CVE-2018-17039 · Other software · 1234n · reported by MITREMedium 6.1
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2018An issue was discovered in MiniCMS 1.10.CVE-2018-16298 · Other software · 1234n · reported by MITREMedium 6.1
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2018MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.CVE-2018-16233 · Other software · 1234n · reported by MITREMedium 6.1
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2018An issue was discovered in MiniCMS 1.10.CVE-2018-15899 · Other software · 1234n · reported by MITREMedium 6.1
An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2018MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injectionCVE-2018-1000638 · Other software · 1234n · reported by MITREMedium 6.1
MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injection.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2018mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.CVE-2018-10424 · Other software · 1234n · reported by MITRELow 2.7
mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2018mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes availCVE-2018-10423 · Other software · 1234n · reported by MITRELow 2.7
mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2018MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.CVE-2018-10296 · Other software · 1234n · reported by MITREMedium 6.1
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2018MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link parameter.CVE-2018-10227 · Other software · 1234n · reported by MITREMedium 5.4
MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link parameter.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2018There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.CVE-2018-9092 · Other software · 1234n · reported by MITREHigh 8.8
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Oct 1, 2012miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an executable extension, whCVE-2012-5231 · Other software · Jessgramp · reported by MITREHigh 7.5
miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an executable extension, which is not properly handled by (a) update.php when writing files to content/, or (b) updatenews.php when writing files to content/news/.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.