CVE-2025-65854: MineAdmin has an insecure default password

critical Affects mineadmin/mineadmin. Feed 2026.10.29.1, updated 2026-10-28; published 2025-12-12; advisory modified 2026-09-10.

MineAdmin has an insecure default password

Package: mineadmin/mineadmin Composer
Affected versions: <=3.0.9
Fixed in: no fix recorded
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 0% (42.4th percentile)
Published: 2025-12-12
Source: osv.dev

References

CWE-94

NVD record mineadmin/mineadmin advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2026-55224 high MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninst same package: mineadmin/mineadmin
CVE-2026-1194 medium MineAdmin May Expose Sensitive Information to an Unauthorized Actor same package: mineadmin/mineadmin
CVE-2026-1196 low MineAdmin May Expose Sensitive Information to an Unauthorized Actor same package: mineadmin/mineadmin
CVE-2026-1193 medium MineAdmin has Incorrect Privilege Assignment same package: mineadmin/mineadmin
CVE-2026-1195 medium MineAdmin improperly refreshes tokens same package: mineadmin/mineadmin
CVE-2017-9841 KEV critical Code Injection in PHPUnit same weakness: CWE-94