Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-46041 — Proof-of-concept for a stored XSS vulnerability in Anchor CMS v0.12.7, demonstrating arbitrary JavaScript execution via the page description field. | Kitploit
Tools/GitHubGitHub/binneko/cve-2025-46041
Vulnerability AnalysisWeb Application ExploitationCTFPenetration TestingLearning & Education
GitHubbinneko/cve-2025-46041

CVE-2025-46041

Proof-of-concept for a stored XSS vulnerability in Anchor CMS v0.12.7, demonstrating arbitrary JavaScript execution via the page description field.

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Anchor CMS v0.12.7 - Stored XSS (CVE-2025-46041)

Anchor CMS v0.12.7 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the description field of the /admin/pages/add interface.

CVE ID

CVE-2025-46041

Summary

  • Type: Stored XSS
  • Location: Page creation interface (/admin/pages/add)
  • Impact: Arbitrary JavaScript execution
  • Authentication Required: Yes (admin or editor user)
  • Affected Version: Anchor CMS v0.12.7 (latest stable at time of discovery)

Proof of Concept

  1. Login to /admin

  • Go to Pages > Add Page

  • In the Description field, insert:

    root@kitploit:~
    <script>alert(document.domain)</script>

  • Save the page.

  • Revisit the page view — the payload executes.

    • Affected Component

    • File: anchor/routes/pages.php
    • Field: description

    Tested On

    • Ubuntu 22.04
    • Apache2 + PHP 8.1
    • Anchor CMS v0.12.7 (fresh install)

    Discoverer

    @binneko

    References

    • Anchor CMS GitHub
    • CVE Record - CVE-2025-46041

    Disclaimer

    For educational and defensive purposes only.

    Download Tool