CVE-2025-65854CWE-94code-injection

CVE-2025-65854

Critical · published December 12, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

🚨 Insecure permissions in the scheduled tasks of MineAdmin v3.x let attackers execute commands like a magician pulling rabbits out of a hat! 🎩💥 Think of it as a restaurant where the chef can serve unverified dishes, allowing anyone to place an order that changes the entire menu without approval. This vulnerability grants attackers complete control over the system, just like a rogue chef running the kitchen! An attacker could take full control of the account, executing arbitrary commands that compromise sensitive data and wreak havoc on your system. This could lead to data breaches, unauthorized access to critical features, and ultimately, total chaos in your MineAdmin environment. The potential for data loss and operational disruption is absolutely devastating!

Put simply

Think of it as a restaurant where the chef can serve unverified dishes, allowing anyone to place an order that changes the entire menu without approval. This vulnerability grants attackers complete control over the system, just like a rogue chef running the kitchen! This vulnerability arises from inadequate permission settings in MineAdmin's scheduled tasks, allowing unauthorized users to run commands as if they were the admin. An attacker can exploit this flaw without any authentication, making it a prime target for exploitation.

What to do

An attacker could take full control of the account, executing arbitrary commands that compromise sensitive data and wreak havoc on your system. This could lead to data breaches, unauthorized access to critical features, and ultimately, total chaos in your MineAdmin environment. The potential for data loss and operational disruption is absolutely devastating! Update MineAdmin to the latest version immediately to address these insecure permissions. Review and tighten permissions on scheduled tasks, ensuring only trusted users can execute commands. Regularly audit your security settings to prevent future risks. You've got this! By following these steps, you'll secure your system and keep those rogue chefs at bay! 🛡️🌟

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00496 · 41.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-12-12T21:15Z
Affected products (1)
ProductVersionsFixed in
mineadmin/mineadmin< 3.03.0
References (2)
EPSS history
Timeline
  • 12 DEC 00:00Z
    Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover
    cvelistv5