Listen to this Post
How the CVE Works
CVE-2025-46041 is a stored XSS vulnerability in Anchor CMS v0.12.7. Attackers can inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add). The payload persists in the database and executes when an admin or user views the affected page. Due to insufficient input sanitization, arbitrary script execution occurs in the context of the victim’s session, potentially leading to session hijacking, defacement, or phishing.
DailyCVE Form
Platform: Anchor CMS
Version: 0.12.7
Vulnerability: Stored XSS
Severity: Medium
Date: 06/25/2025
Prediction: Patch by 08/2025
What Undercode Say
Check for vulnerable versions grep -r "0.12.7" /var/www/html/anchor/ PoC XSS payload <script>alert(document.cookie)</script> Mitigation test (sanitization) echo htmlspecialchars($_POST['description']);
How Exploit
1. Authenticate as low-privilege user.
2. Navigate to `/admin/pages/add`.
3. Inject malicious script in description field.
4. Save page; payload triggers on view.
Protection from this CVE
- Update to patched version.
- Sanitize user input (htmlspecialchars).
- Implement CSP headers.
Impact
- Session hijacking.
- Admin account compromise.
- Data exfiltration.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
