CVE-2018-7251
Anchor CMS Logs Credentials
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
- Record
CVE-2018-7251- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
- Record
CVE-2018-7251- Updated
- 2026-11-02
EUVDEUVD-2022-4239 No score
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
- Record
EUVD-2022-4239- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hxcw-pqqc-rv85
Anchor CMS Logs Credentials
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
- Record
GHSA-hxcw-pqqc-rv85- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
- Record
CVE-2018-7251- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-hxcw-pqqc-rv85
Anchor CMS Logs Credentials
An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
- Record
GHSA-hxcw-pqqc-rv85- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
anchorcms/anchor-cmsPackagist |
before 0.12.7 | 0.12.7 |
anchorcms/anchor-cmsPackagist |
before 0.12.7, plus listed versions 0.110.120.12.10.12.30.12.3a Show 8 moreShow less0.12.60.90.9.10.9.20.9.30.9.3-a0.9.3-b0.9.3.1-a |
0.12.7 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | AnchorCMS < 0.12.3a - Information Disclosure | 2019-10-03 |
| Nuclei | Anchor CMS 0.12.3 - Error Log Exposure |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7251 is a critical vulnerability (CVSS 9.8) in Anchorcms Anchor, published February 19, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 71.8%, the 99th percentile. Fixed in anchorcms/anchor-cms 0.12.7.
References
github.com/anchorcms/anchor-cms/issues/1247
andmp.com/2018/02/advisory-assigned-CVE-2018-7251-in-anchorcms.html
twitter.com/finnwea/status/965279233030393856
packetstormsecurity.com/files/154723/Anchor-CMS-0.12.3a-Information-Disclosure.html
nvd.nist.gov/vuln/detail/CVE-2018-7251