GHSA-x6mh-4w8x-p34v

MineAdmin has an insecure default password

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-65854

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	mineadmin/mineadmin	<= 3.0.9	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-65854 advisory
https://gist.github.com/SourByte05/1a6c6b08ac47c5d58eb7dd4422cc23b7 web
https://github.com/mineadmin/mine-core/blob/7994da7f5cd0778eb9aadd550c50c259cc1d1048/src/Command/InstallProjectCommand.php#L123 web
https://github.com/mineadmin/mineadmin package
http://mineadmin.com web