CVE-2018-17025

2018-09-1320:29:00

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.3%

JSON

admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role.

CPENameOperatorVersion
monstraeq2.2.0
monstraeq3.0.2
monstraeq2.3.1
monstraeq2.3.0
monstraeq3.0.4
monstraeq3.0.0
monstraeq3.0.3
monstraeq2.2.1
monstraeq3.0.1

Name	Operator	Version
monstra	eq	2.2.0
monstra	eq	3.0.2
monstra	eq	2.3.1
monstra	eq	2.3.0
monstra	eq	3.0.4
monstra	eq	3.0.0
monstra	eq	3.0.3
monstra	eq	2.2.1
monstra	eq	3.0.1

References

github.com/monstra-cms/monstra/issues/458