CVE-2018-15886

2018-09-1013:00:00

mitre

www.cve.org

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.2%

JSON

Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=edit_snippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a <?php substring.

References

github.com/monstra-cms/monstra/issues/455