Anchorcms develops a lightweight, open-source content management system that, despite a narrow product scope, occupies a niche in the web-application landscape and has attracted public exploit tooling for its vulnerabilities. The vendor's disclosures cluster around input-handling and web-tier weaknesses including cross-site scripting, cross-site request forgery, code injection, and sensitive-information exposure, reflecting the template-rendering and user-input processing demands of a CMS platform. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Anchorcms over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-7251CRITICAL An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many conn | Feb 19, 2018 | 9.8 | 85 | NO | YES |
CVE-2020-23342HIGH A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users. | Jan 19, 2021 | 8.8 | 44 | NO | YES |
CVE-2025-46041MEDIUM A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interfac | Jun 9, 2025 | 5.4 | 28 | NO | YES |
CVE-2024-37732MEDIUM Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. | Jun 24, 2024 | 6.1 | 24 | NO | NO |
CVE-2024-29499HIGH Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2. | Mar 22, 2024 | 7.4 | 21 | NO | NO |
CVE-2021-44116MEDIUM Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to | Dec 15, 2021 | 6.1 | 21 | NO | NO |
CVE-2015-5687HIGH system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object | Oct 5, 2015 | 7.5 | 20 | NO | NO |
CVE-2022-25576MEDIUM Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delet | Mar 24, 2022 | 4.5 | 19 | NO | NO |
CVE-2015-5060MEDIUM Cross-site scripting (XSS) vulnerability in anchor-cms before 0.9-dev. | Sep 7, 2017 | 6.1 | 17 | NO | NO |
CVE-2014-9182MEDIUM models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header. | Dec 2, 2014 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Anchorcms.
Media articles that mention a CVE ID that affects a product developed by Anchorcms — matched by CVE ID, not by vendor name.