anchorcms

Records14All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

anchorcms records in CISA KEV

No anchorcms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Anchor Cms 11 records HIGH Anchor 2 records HIGH

Records

14 records

TI-2018-05260 CVE-2018-7251 · GHSA-hxcw-pqqc-rv85

An issue was discovered in config/error.php in Anchor 0.12.3.

HIGH 80

An issue was discovered in config/error.php in Anchor 0.12.3.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.7183 Published 2018-02-19 Fixed in 0.12.7 CWE-200

TI-2024-25129 CVE-2024-37732 · GHSA-vqjg-5pqm-q7ph

Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to…

HIGH 73

Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.16612 Published 2024-06-24 No fix listed CWE-80

TI-2024-19470 CVE-2024-29499 · GHSA-4xw8-9fj7-j58j

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2.

HIGH 66

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00251 Published 2024-03-22 No fix listed CWE-352

TI-2025-28918 CVE-2025-46041 · GHSA-cc44-4fcv-cqh7

A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00645 Published 2025-06-09 No fix listed CWE-79

TI-2020-14539 CVE-2020-23342 · GHSA-p669-fw7h-w3hf

A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.

MEDIUM 52

A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.12428 Published 2021-01-19 No fix listed CWE-352

TI-2024-19430 CVE-2024-29338 · GHSA-2whx-ccr7-fxqm

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.

MEDIUM 46

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.

CVSS 3.1LOW 2.4 Network High privileges User interaction EPSS 0.00255 Published 2024-03-22 No fix listed CWE-352

TI-2026-60305 CVE-2026-88959 · GHSA-gpm9-mh97-xhwr

Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints

MEDIUM 40

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00523 Published 2026-09-10 No fix listed CWE-862

TI-2015-04793 CVE-2015-5687 · GHSA-fq89-qvg6-5qrj

system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct…

LOW 38

system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02501 Published 2015-10-05 No fix listed CWE-94

TI-2021-19829 CVE-2021-44116 · GHSA-7mq6-cp5m-f4j5

Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php.

LOW 29

Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0077 Published 2021-12-15 No fix listed CWE-79

TI-2015-04242 CVE-2015-5060 · GHSA-v53p-79cq-hx83

Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev.

LOW 28

Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00652 Published 2017-09-07 No fix listed CWE-79

TI-2021-21136 CVE-2021-46253 · GHSA-7r9c-fccw-3vrf

A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS…

LOW 25

A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00617 Published 2022-02-01 No fix listed CWE-79

TI-2020-09723 CVE-2020-12071 · GHSA-6q7r-xj8w-7p6h

Anchor 0.12.7 allows admins to cause XSS via crafted post content.

LOW 23

Anchor 0.12.7 allows admins to cause XSS via crafted post content.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00564 Published 2020-04-23 No fix listed CWE-79

TI-2014-07450 CVE-2014-9182 · GHSA-m8ff-63v2-7fmv

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject…

LOW 22

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01007 Published 2014-12-02 No fix listed CWE-79

TI-2022-09175 CVE-2022-25576 · GHSA-322v-p3jc-7hrg

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…

LOW 21

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php.

CVSS 3.1MEDIUM 4.5 Network High privileges User interaction EPSS 0.00401 Published 2022-03-24 No fix listed CWE-352

Open these records in search →

Critical	1
High	5
Medium	7
Low	1
No CVSS	0