Open-source package vulnerability · Composer (PHP)

CVE-2025-65854: MineAdmin has an insecure default password

criticalCVSS 3.1 9.8GHSA-x6mh-4w8x-p34v

Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover.

Published Dec 12, 2025

Affected packages

mineadmin/mineadmin

Ecosystem: Composer (PHP)
Affected: <= 3.0.9
Fixed in: No patched version yet
Check: composer show mineadmin/mineadmin

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-65854
https://gist.github.com/SourByte05/1a6c6b08ac47c5d58eb7dd4422cc23b7
https://github.com/mineadmin/mine-core/blob/7994da7f5cd0778eb9aadd550c50c259cc1d1048/src/Command/InstallProjectCommand.php#L123
https://github.com/advisories/GHSA-x6mh-4w8x-p34v

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology