Is CVE-2025-65854 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65854 being exploited in the wild.

How severe is CVE-2025-65854?

Critical severity, with a CVSS score of 9.8, published 12 December 2025.

Which products and versions are affected?

Mineadmin < 3.0; mineadmin/mineadmin (Packagist) ECOSYSTEM:introduced=0,last_affected=3.0.9.

Is there a fix for CVE-2025-65854?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-65854 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-65854?

Check whether you run Mineadmin or mineadmin/mineadmin (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65854: MineAdmin code injection in scheduled tasks feature

Q: Which products and versions are affected?

Mineadmin < 3.0; mineadmin/mineadmin (Packagist) ECOSYSTEM:introduced=0,last_affected=3.0.9.

Q: Is there a fix for CVE-2025-65854?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-65854 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2025-65854?

Check whether you run Mineadmin or mineadmin/mineadmin (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65854 · Severity: critical · CVSS 9.8 · Published 2025-12-12

MineAdmin, a web-based administrative dashboard, contains a critical security flaw in its scheduled tasks feature. Attackers can exploit insecure default credentials or weak permissions to gain administrative access and execute malicious commands on the underlying server. This could lead to a complete takeover of the application, theft of sensitive data, or a total service outage.

Technologies: mineadmin/mineadmin (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2025-65854 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65854 being exploited in the wild.
How severe is CVE-2025-65854?: Critical severity, with a CVSS score of 9.8, published 12 December 2025.
Which products and versions are affected?: Mineadmin < 3.0; mineadmin/mineadmin (Packagist) ECOSYSTEM:introduced=0,last_affected=3.0.9.
Is there a fix for CVE-2025-65854?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-65854 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-65854?: Check whether you run Mineadmin or mineadmin/mineadmin (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

MineAdmin versions prior to 3.0 are vulnerable to Remote Code Execution (RCE) due to insecure permissions in the 'Scheduled Tasks' component. The vulnerability is exacerbated by the presence of default administrative credentials (superAdmin/admin123). An attacker who gains access to the administrative interface can navigate to the 'Add Scheduled Task' form and inject malicious PHP code (e.g., using eval() or system() functions) into the task definition. When the task is executed, the payload is triggered on the server. This is classified as Improper Control of Generation of Code (CWE-94). Users are advised to upgrade to version 3.0 or later and change default passwords immediately.

Affected products

MineAdmin MineAdmin < 3.0

Identifiers

CVE-2025-65854
GHSA-x6mh-4w8x-p34v

Timeline

2025-12-12: disclosed: Initial disclosure via GitHub Gist and NVD publication.
2025-12-19: advisory: NVD enrichment and CPE configuration added.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.