monstra monstra cms vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

Monstra CMS 3.0.4 and previous versions has XSS via index.php.

Monstra Monstra Cms

5

CVSSv2

plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie.

Monstra Monstra Cms 3.0.4

3.5

CVSSv2

A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows malicious users to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings" module.

Monstra Monstra Cms 3.0.4

6.5

CVSSv2

Monstra CMS 3.0.4 allows malicious users to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.

Monstra Monstra Cms 3.0.4

3.5

CVSSv2

Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product.

Monstra Monstra Cms 1.6

6.5

CVSSv2

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=edit_chunk URI. NOTE: there is no indication...

Monstra Monstra Cms 3.0.4

3.5

CVSSv2

Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.

Monstra Monstra Cms 3.0.4

5.8

CVSSv2

An issue in Monstra CMS v3.0.4 allows malicious users to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files.

Monstra Monstra Cms 3.0.4

6.5

CVSSv2

Monstra CMS up to and including 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a ...

Monstra Monstra

5.5

CVSSv2

Monstra CMS 3.0.4 allows remote malicious users to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ request.

Monstra Monstra 3.0.4

1 EDB exploit

Get Started

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook