CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 22/03/2024 |
| CVE-2022-25576 | 中危4.5 | Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts. | 24/03/2022 |
| CVE-2021-46253 | 中危5.4 | A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML. | 01/02/2022 |
| CVE-2021-44116 | 中危6.1 | Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations. | 15/12/2021 |
| CVE-2020-23342 | 高危8.8 | A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users. | 19/01/2021 |
| CVE-2020-12071 | 中危4.8 | Anchor 0.12.7 allows admins to cause XSS via crafted post content. | 23/04/2020 |
| CVE-2018-7251 | 严重9.8 | An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred. | 19/02/2018 |
| CVE-2015-5060 | 中危6.1 | Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev. | 07/09/2017 |
| CVE-2015-5687 | 高危7.5 | system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie. | 05/10/2015 |
| CVE-2014-9182 | 中危4.3 | models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header. | 02/12/2014 |