{"id":"GHSA-x6mh-4w8x-p34v","aliases":["CVE-2025-65854"],"title":"MineAdmin has an insecure default password","description":"Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover.","severity":"critical","score":9.8,"published":"2025-12-12T18:30:35.000Z","modified":"2026-09-10T03:50:32.279Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"mineadmin/mineadmin","ranges":[{"events":[{"introduced":"0"},{"last_affected":"3.0.9"}],"type":"ECOSYSTEM"}],"versions":["2.0.0-alpha.1","v0.6.2","v0.6.3","v0.7.0","v0.7.1","v0.7.2","v1.0.0","v1.1.0","v1.1.1","v1.2.0","v1.2.1","v1.3.0","v1.3.3","v1.4.1","v1.4.11","v1.4.12","v1.4.13","v2.0-RC.1","v2.0.0-alpha.2","v2.0.0-alpha.3","v2.0.0-alpha.4","v2.0.0-alpha.5","v2.0.0-beta","v2.0.0-beta.1","v2.0.0-beta.2","v2.0.0-beta.3","v2.0.0-beta.4","v2.0.0-beta.5","v2.0.0-beta.6","v2.0.1","v2.0.1.1","v2.0.2","v2.0.3","v3.0","v3.0-RC","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.0.6","v3.0.7","v3.0.8","v3.0.9"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-65854","https://gist.github.com/SourByte05/1a6c6b08ac47c5d58eb7dd4422cc23b7","https://github.com/mineadmin/mine-core/blob/7994da7f5cd0778eb9aadd550c50c259cc1d1048/src/Command/InstallProjectCommand.php#L123","https://github.com/mineadmin/mineadmin","http://mineadmin.com"],"sources":[{"name":"OSV","id":"GHSA-x6mh-4w8x-p34v","modified":"2026-09-10T03:50:32.279596109Z","url":"https://osv.dev/vulnerability/GHSA-x6mh-4w8x-p34v"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}]}