GHSA-7mq6-cp5m-f4j5

Cross-site Scripting in Anchor CMS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-44116

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	anchorcms/anchor-cms	<= 0.12.7	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-44116 advisory
https://github.com/anchorcms/anchor-cms package
https://www.cnblogs.com/unrealnumb/p/15573449.html web