CVE-2018-11678

Monstra CMS 3.0.4 is affected: the plugin file plugins/box/users/users.plugin.php allows a Login Rate Limiting Bypass by manipulating the login_attempts cookie. Root cause: bypasses brute-force protection in the login form. Impact per sources is high; CVSSv3 indicates CRITICAL with network access...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-15388)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the registry of Monstra CMS version 3.0.4, which stems from th...

Cross site scripting

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

CVE-2018-11472

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

CVE-2018-11473

Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...

CVE-2018-11472

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

CVE-2018-11475

Summary : Monstra CMS 3.0.4 is affected by a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser. Impact : a user’s active session remains valid in other browsers after a password change (per the CVE descri...

CVE-2018-11473

Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...

CVE-2018-11472

CVE-2018-11472 concerns Monstra CMS 3.0.4, where the login parameter to admin/index.php is vulnerable to a reflected XSS. The connected sources consistently describe this vector as a reflected XSS during login, with no public details beyond that in the provided materials. CVSS data are present (v...

Monstra CMS 3.0.4 Remote Code Execution

Exploit Title: Monstra CMS 3.0.4 Upload Plugin Remote code execution CVE-2018-9037 Date: 2018-05-14 Exploit Author: Jameel Nabbo Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested on: MAC OSX CVE :CVE-2018-9037 Monst...

Monstra cms 3.0.4 - Persitent Cross-Site Scripting

Monstra cms 3.0.4 - Persitent Cross-Site Scripting Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting Date: 2018-04-14 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested o...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-08254)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in Monstra CMS version 3.0.4. A remote attacker can exploit the...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-08255)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in Monstra CMS version 3.0.4. The vulnerability can be exploited ...

CVE-2018-10118

Monstra CMS 3.0.4 is affected by a Stored XSS in the Name field on the Create New Page screen (admin/index.php?id=pages), related to plugins/box/pages/pages.admin.php. This CVE details the vulnerable component path and the input point that leads to script execution. The connected data confirms th...

Monstra CMS Remote Code Execution Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in Monstra CMS version 3.0.4. The vulnerability can be exploited by a remote...

Monstra CMS File Deletion Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in Monstra CMS version 3.0.4. A remote attacker can send a message to...

CVE-2018-9037

Monstra CMS 3.0.4 allows remote code execution via an uploadfile request for a .zip file, which is automatically extracted and may contain .php files...

CVE-2018-7477

SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parentmodule/parentlogin.php...

CVE-2018-7477

The CVE-2018-7477 entry describes a SQL injection in PHP Scripts Mall School Management Script 3.0.4 that allows authentication bypass via the login page at parents/Parent_module/parent_login.php. Multiple connected sources corroborate a vulnerability in the Username/Password fields enabling admi...

IBM Financial Transaction Manager Denial of Service Vulnerability

IBM Financial Transaction Manager FTM for ACH Services is a Financial Transaction Manager product from IBM USA, which is used to monitor, track and report on financial payments and transactions. A denial of service vulnerability exists in IBM Financial Transaction Manager FTM for ACH Services...