Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)