CVE-2015-5060

Cross-site scripting XSS vulnerability in anchor-cms before 0.9-dev...

CVE-2015-5060

CVE-2015-5060 is an XSS vulnerability in anchor-cms prior to version 0.9-dev. The CNVD entry confirms the issue affects anchor-cms with an open XSS flaw that allows a remote attacker to inject arbitrary script/HTML. The NVD record reiterates the vulnerability as a cross-site scripting flaw in anc...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. The attacks exists because write function in system/cookie.php does not enforce the HttpOnly header when creating cookies...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. These attacks are possible because the comment output from commenttext is not filtered and encoded properly, allowing a malicious user to inject and execute arbitrary web script through it...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS attacks. The attacks are possible because 404 errors and uncaught exception error are not filtered and encoded properly, allowing a malicious user to inject and execute arbitrary web script through a URI...

Anchor CMS 0.12.1 Cross Site Scripting

======================================================================== | Title : Anchor cms 0.12.1 bundled XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : 5.2.0 | Vendor :...

CVE-2015-5687

system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie...

CVE-2015-5687

system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie...

CVE-2015-5687

AnchorCMS 0.9.x is vulnerable to PHP object injection and arbitrary code execution via a crafted serialized object in a cookie. The root cause is the cookie-based session driver failing to filter malicious serialized objects in the cookie, allowing an attacker to inject PHP objects and execute co...

Anchor CMS PHP Object Injection Vulnerability

Exploit for php platform in category web applications CVE-2015-5687 PHP Object Injection in AnchorCMS ================================================= Out of the box, AnchorCMS defaults to store all session state in a cookie contrast this with only storing a unique identifier in a cookie which...

Anchor CMS 0.9.2 Cross Site Scripting

Affected Vendor: http://anchorcms.com/ Date: 23/03/2015 Discovered by: JoeV Type of vulnerability: XSS Tested on: Windows 7 Version: 0.9.2 Description: Anchor CMS v 0.9.2 is susceptible to Cross Site Scripting attack. Proof of Concept PoC: --------------------------- XSS --- POST...

CVE-2014-9182

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header...

CVE-2014-9182

Anchor CMS 0.9.2 and earlier is affected by CVE-2014-9182 due to a header-injection flaw in models/comment.php. The vulnerability arises from building mail headers using a Host header value, enabling remote attackers to inject arbitrary headers into outgoing mail messages via CRLF manipulation. T...

CVE-2014-9182

models/comment.php in Anchor CMS 0.9.2 and earlier allows remote attackers to inject arbitrary headers into mail messages via a crafted Host: header...

Anchor CMS 0.9.2 Header Injection Vulnerability

Anchor CMS versions 0.9.2 and below suffer from a header injection vulnerability. Anchor CMS = 0.9.2 Current Version header injection in anchor/models/comment.php $headers = 'MIME-Version: 1.0' . "\r\n"; $headers .= 'Content-type: text/html; charset=utf-8' . "\r\n"; $headers .= 'From:...

Anchor CMS 0.9.2 Header Injection

Anchor CMS = 0.9.2 Current Version header injection in anchor/models/comment.php $headers = 'MIME-Version: 1.0' . "\r\n"; $headers .= 'Content-type: text/html; charset=utf-8' . "\r\n"; $headers .= 'From: notifications@' . $SERVER'HTTPHOST' . "\r\n"; 49: mail$to, 'comments.notifysubject', $message...

Anchor CMS 0.9.1 - Stored XSS Vulnerability

No description provided by source. Exploit Title : AnchorCMS Stored XSS exploit v0.9.1 Exploit Author: DURAKIBOX / dn5 Website : halisduraki.com Email : [email protected] Date : 18.7.2013. CMS uri : http://anchorcms.com/ Version : AnchorCMS = 0.9.1 About the CMS Anchor is a super-simple, lightweigh...

CVE-2013-5099

Cross-site scripting XSS vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are us...

Cross site scripting

Cross-site scripting XSS vulnerability in article.php in Anchor CMS 0.9.1, when comments are enabled, allows remote attackers to inject arbitrary web script or HTML via the Name field. NOTE: some sources have reported that comments.php is vulnerable, but certain functions from comments.php are us...

CVE-2013-5099

Summary: CVE-2013-5099 affects Anchor CMS 0.9.1. A cross-site scripting (XSS) vulnerability exists in article.php when comments are enabled, allowing remote attackers to inject arbitrary script/HTML via the Name field. Some sources note involvement of comments.php, but article.php calls relevant ...