CVE-2015-5687
HighSummary
The Anchor CMS version 0.9.x has a vulnerability that allows remote attackers to conduct PHP object injection attacks. Attackers can execute arbitrary PHP code via a crafted serialized object in a cookie.
Risk Assessment
This vulnerability poses a serious risk to application security, allowing attackers to execute code remotely, potentially leading to system compromise.
Recommendation
It is recommended to update Anchor CMS to the latest version that addresses this vulnerability and to review and validate cookie handling mechanisms in the application.
Other vulnerabilities in Anchor CMS 0.9.x
See all- CVE-2026-88959High
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints. Any authenticated low-privilege user can POST directly to admin/users/add or admin/users/edit to create administrator accounts or change the existing administrator's password.
- CVE-2025-46041Medium
A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).
Original NVD description (English source)
system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie.