All packages
Anchor CMS vulnerabilities
3 known CVE vulnerabilities in Anchor CMS, translated and rated.
- CVE-2026-88959High
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints. Any authenticated low-privilege user can POST directly to admin/users/add or admin/users/edit to create administrator accounts or change the existing administrator's password.
- CVE-2015-5687High
The Anchor CMS version 0.9.x has a vulnerability that allows remote attackers to conduct PHP object injection attacks. Attackers can execute arbitrary PHP code via a crafted serialized object in a cookie.
- CVE-2025-46041Medium
A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).