{"id":"CVE-2018-7251","aliases":["EUVD-2022-4239","GHSA-hxcw-pqqc-rv85"],"status":"published","title":"Anchor CMS Logs Credentials","description":"An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.7183,"percentile":0.99429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200"],"published":"2018-02-19T22:00:00Z","modified":"2026-10-20T10:49:56Z","exploits":[{"source":"exploitdb","id":"EDB-47459","title":"AnchorCMS \u003c 0.12.3a - Information Disclosure","type":"webapps","platform":"multiple","date":"2019-10-03","url":"https://www.exploit-db.com/exploits/47459"},{"source":"nuclei","id":"CVE-2018-7251","title":"Anchor CMS 0.12.3 - Error Log Exposure","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7251.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"anchorcms/anchor-cms","fixed_in":["0.12.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"anchorcms/anchor-cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7"}]}]},{"source":"osv","ecosystem":"Packagist","package":"anchorcms/anchor-cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7"}]}],"versions":["0.11","0.12","0.12.1","0.12.3","0.12.3a","0.12.6","0.9","0.9.1","0.9.2","0.9.3","0.9.3-a","0.9.3-b","0.9.3.1-a"]}],"products":[{"vendor":"anchorcms","product":"anchor"}],"references":[{"url":"https://github.com/anchorcms/anchor-cms/issues/1247","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"http://www.andmp.com/2018/02/advisory-assigned-CVE-2018-7251-in-anchorcms.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://twitter.com/finnwea/status/965279233030393856","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/154723/Anchor-CMS-0.12.3a-Information-Disclosure.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/anchorcms/anchor-cms/releases/tag/0.12.7","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7251","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hxcw-pqqc-rv85"},{"url":"https://github.com/anchorcms/anchor-cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-7251","description":"An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred.","status":"published","published":"2018-02-19T22:00:00Z","modified":"2024-08-05T06:24:11.682Z","updated_at":"2026-11-02T14:35:09.908186Z"}],"euvd":[{"id":"EUVD-2022-4239","description":"An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred.","status":"published","published":"2018-02-19T22:00:00Z","modified":"2024-08-05T06:24:11Z","updated_at":"2026-11-03T02:40:05.625439Z"}],"ghsa":[{"id":"GHSA-hxcw-pqqc-rv85","title":"Anchor CMS Logs Credentials","description":"An issue was discovered in `config/error.php` in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred.","status":"published","published":"2022-05-13T01:39:42Z","modified":"2023-10-06T17:53:47Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:08.278692Z"}],"nvd":[{"id":"CVE-2018-7251","description":"An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred.","status":"published","published":"2018-02-19T22:29:00.22Z","modified":"2026-06-17T02:02:52.64Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:23.783914Z"}],"osv":[{"id":"CVE-2018-7251","description":"An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred.","status":"published","published":"2018-02-19T22:29:00.22Z","modified":"2026-10-20T10:49:56.496776489Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"GHSA-hxcw-pqqc-rv85","title":"Anchor CMS Logs Credentials","description":"An issue was discovered in `config/error.php` in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as \"Too many connections\") has occurred.","status":"published","published":"2022-05-13T01:39:42Z","modified":"2024-02-16T08:24:04.611511Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}