Anchor Cms
Approved changes feed: RSS · Atom
cpe:2.3:a:anchorcms:anchor_cms:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Anchorcms (60dcecda-3a70-58ff-abbf-e80ee06de3d3) |
|---|---|
| Product | Anchor Cms (7a4c3b55-aa3d-5a93-948d-6aa614d28951) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/anchorcms/anchor-cms |
purl2cpe | 2026-06-01 10:14:58.920693 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-88959 |
vulnerable | 2026-09-16 04:34:09.255913 |
Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints
HIGH (8.8)
Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, gaining full administrative access.
Published: 2026-09-10T15:44:12.945Z
Updated: 2026-09-24T14:21:33.183Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-44116 |
vulnerable | 2026-06-08 05:36:44.948029 |
Details available
Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations.
Published: 2021-12-15T22:00:46.000Z
Updated: 2024-08-04T04:10:17.295Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5060 |
vulnerable | 2026-06-08 05:06:48.712140 |
Details available
Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev.
Published: 2017-09-07T20:00:00.000Z
Updated: 2024-08-06T06:32:32.748Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-9182 |
vulnerable | 2026-06-08 05:06:11.052225 |
Details available
models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header.
Published: 2014-12-02T18:00:00.000Z
Updated: 2024-09-16T17:28:44.632Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.