CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE

이 내용을 readme.md로 만들어 붙여넣으세요. CVE-2025-69906: Monstra CMS 3.0.4 임의 파일 업로드를 통한 원격 코드 실행 RCE 작성자 : David PS Abraham 날짜 : 2026년 2월 5일 심각도 : 치명적 - 원격 코드 실행 CVSS 8.8+ CWE : 434 위험한 유형의 파일 무제한 업로드 취약점 설명 Monstra CMS v3.0.4의 파일 관리자 플러그인plugins/box/filesmanager/filesmanager.admin.php은 블랙리스트 기반 파일 확장자 검증 을...

CVE-2025-69906

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...

EUVD-2025-206862

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...

CVE-2025-69906

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...

CVE-2025-69906

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...

Monstra CMS 安全漏洞

Monstra CMS is a lightweight content management system CMS developed by Sergey Romanenko from Ukraine using PHP. Version 3.0.4 of Monstra CMS has a security vulnerability. This vulnerability stems from the Files Manager plugin, which allows arbitrary file uploads. The application relies on...

PT-2026-6595

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description Monstra CMS version 3.0.4’s Files Manager plugin has an issue where arbitrary files can be uploaded. The application uses a blacklist to validate file extensions and stores uploaded files in a directory...

CVE-2025-69906

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...

CVE-2025-69906: Unrestricted Upload of File with Dangerous Type

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...

CVE-2025-69906

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...

CVE-2025-69906

Monstra CMS version 3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin, specifically within plugins/box/filesmanager/filesmanager.admin.php. The root cause is a weak blacklist-based file extension validation that fails to block various bypass techniques, such as cas...

Exploit for CVE-2025-69906

make it a readme.md to paste into it CVE-2025-69906: Monstra...

EUVD-2025-30327

Malicious code in bioql PyPI...

CVE-2025-56869

Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in...

CVE-2025-56869

Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in...

Sync in 安全漏洞

Sync in is a server synchronization platform from Sync-in open source. A security vulnerability exists in Sync in 1.1.1 and earlier versions, which stems from a directory traversal issue in the FilesManager.saveMultipart and FilesManager.compress functions that could allow an authenticated attack...

CVE-2025-56869

Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in...

CVE-2025-56869

Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in...

CVE-2025-56869

Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in...

PT-2025-38583

Name of the Vulnerable Software and Affected Versions Sync In versions through 1.1.1 Description A directory traversal issue exists in Sync In server. Authenticated attackers can achieve read and write access to the system through the FilesManager.saveMultipart function located in...