{"id":"GHSA-322v-p3jc-7hrg","aliases":["CVE-2022-25576"],"title":"Cross-Site Request Forgery in Anchor CMS","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.","severity":"medium","score":4.5,"published":"2022-03-26T00:00:34.000Z","modified":"2023-11-08T04:08:47.287Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"anchorcms/anchor-cms","sources":[{"name":"OSV · GHSA-322v-p3jc-7hrg","url":"https://osv.dev/vulnerability/GHSA-322v-p3jc-7hrg"}],"ranges":[{"events":[{"introduced":"0"},{"last_affected":"0.12.7"}],"type":"ECOSYSTEM"}],"versions":["0.11","0.12","0.12.1","0.12.3","0.12.3a","0.12.6","0.12.7","0.9","0.9.1","0.9.2","0.9.3","0.9.3-a","0.9.3-b","0.9.3.1-a"],"fixed":[]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-25576","https://github.com/anchorcms/anchor-cms","https://github.com/butterflyhack/anchorcms-0.12.7-CSRF"],"sources":[{"name":"OSV","id":"GHSA-322v-p3jc-7hrg","modified":"2023-11-08T04:08:47.287359Z","url":"https://osv.dev/vulnerability/GHSA-322v-p3jc-7hrg"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","score":4.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T01:45:31.656Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}