CVE-2025-15457: Improper Authentication

A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Trash File Restore Handler. Performing a manipulation results in improper authentication. It is possible to initiate the attack remotely. The...

CVE-2019-9603: Cross-Site Request Forgery (CSRF)

MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891...

PT-2019-19742

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for the deletion of articles via a CSRF vulnerability in the "mc-admin/post.php" endpoint, specifically when the "state" parameter is set to "publish" and the "delete" parameter is utilized...

CVE-2018-18890: Improper Limitation of a Pathname to a Restricted Directory

MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename...

PT-2018-14712

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for file deletion due to an authentication check occurring too late. This can be exploited via the "/mc-admin/post.php?state=delete&delete=" endpoint, where an attacker can delete files without...

CVE-2018-18891: Improper Authentication

MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late...

PT-2018-14711

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for full path disclosure through the "/mc-admin/post.php" endpoint with specific parameters, such as state set to "delete" and delete set to an invalid filename. Recommendations For MiniCMS...

PT-2018-13474

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description An issue was discovered in MiniCMS. There is an XSS vulnerability in the 'mc-admin/post.php' endpoint for requests with a 'state' parameter set to 'delete', 'draft', or 'publish'. Recommendations For MiniCMS...

CVE-2018-16298: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request...

CVE-2018-10423

mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article...

MiniCMS Information Disclosure Vulnerability (CNVD-2018-08993)

MiniCMS is a mini content management system CMS designed for personal websites. An information disclosure vulnerability exists in the mc-admin/post.php file in MiniCMS version 1.10. A remote attacker can exploit this vulnerability to view all files located in the web root path...

CVE-2018-10423: Exposure of Sensitive Information to an Unauthorized Actor

mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article...

PT-2018-9876

Name of the Vulnerable Software and Affected Versions: MiniCMS version 1.10 Description: The issue allows remote attackers to obtain a directory listing of the top-level directory of the web root. This can be achieved by creating a link that becomes available after posting an article, specificall...