Anchorcms

CVE-2026-88959 Sep 10, 15:44 HIGH Monitor

Privilege escalation in Anchor CMS through 0.12.7 allows any authenticated low-privilege user (editor or user role) to create new administrator accounts or hijack the existing administrator's password by directly POSTing to unprotected admin/users/add and admin/users/edit endpoints. The CMS fails to enforce role-based access control at the controller level, meaning the admin user-management routes accept low-privilege session tokens without verifying elevated permissions. A publicly available proof-of-concept exists via a referenced GitHub gist; no vendor-released patch has been identified at time of analysis, and the project appears to be unmaintained at version 0.12.7.

CVE-2025-46041 Jun 09, 17:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).

CVE-2024-37732 Jun 24, 19:15 MEDIUM POC THREAT This Month

Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-29499 Mar 22, 17:15 PHP HIGH POC This Week

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-29338 Mar 22, 17:15 PHP LOW POC Monitor

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2. Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-25576 Mar 24, 23:15 PHP MEDIUM POC This Month

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-44116 Dec 15, 22:15 PHP MEDIUM POC This Month

Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-12071 Apr 23, 02:15 MEDIUM POC This Month

Anchor 0.12.7 allows admins to cause XSS via crafted post content. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-7251 Feb 19, 22:29 PHP CRITICAL POC PATCH THREAT Act Now

An issue was discovered in config/error.php in Anchor 0.12.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2015-5060 Sep 07, 20:29 MEDIUM POC This Month

Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2015-5687 Oct 05, 14:59 HIGH This Week

system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2014-9182 Dec 02, 18:59 MEDIUM POC This Month

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.