381 matches found
monstra_cms-3.0.4--getshell
monstracms-3.0.4--getshell monstracms-3.0.4-upload getshell CVE-2018-17418 Code analysis: In line 150 of monstra\plugins\box\filesmanager\filesmanager.admin.php, there is a forbiddentypes variable used as a blacklist restriction. Continue to follow this variable. In the line 150 of...
Monstra CMS 3.0.4 - Cross-Site Scripting
Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the registration form i.e., the login parameter to users/registration. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...
Monstra CMS <=3.0.4 - Cross-Site Scripting
Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...
Monstra CMS 3.0.4 - Cross-Site Scripting
Monstra CMS 3.0.4 contains a cross-site scripting vulnerability via the page feature in admin/index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...
CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE
hazlo un readme.md para pegarlo CVE-2025-69906: Monstra CMS 3.0.4 Subida Arbitraria de Archivos a RCE Autor : David PS Abraham Fecha : 5 de febrero de 2026 Severidad : Crítica - Ejecución Remota de Código CVSS 8.8+ CWE : 434 Subida sin restricciones de archivos de tipo peligroso Descripción de la...
CVE-2025-69906
Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...
PT-2026-6595
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description Monstra CMS version 3.0.4’s Files Manager plugin has an issue where arbitrary files can be uploaded. The application uses a blacklist to validate file extensions and stores uploaded files in a directory...
CVE-2025-69906
Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...
Monstra CMS 安全漏洞
Monstra CMS is a lightweight content management system CMS developed by Sergey Romanenko from Ukraine using PHP. Version 3.0.4 of Monstra CMS has a security vulnerability. This vulnerability stems from the Files Manager plugin, which allows arbitrary file uploads. The application relies on...
CVE-2025-69906
Monstra CMS version 3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin, specifically within plugins/box/filesmanager/filesmanager.admin.php. The root cause is a weak blacklist-based file extension validation that fails to block various bypass techniques, such as cas...
CVE-2025-69906: Unrestricted Upload of File with Dangerous Type
Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to...
Exploit for CVE-2025-69906
make it a readme.md to paste into it CVE-2025-69906: Monstra...
📄 Monstra CMS 3.0.4 Shell Upload
Monstra CMS version 3.0.4 proof of concept remote shell upload exploit. ============================================================================================================================================= | Title : Monstra CMS 3.0.4 shell upload Vulnerability | | Author : indoushka | |...
CVE-2018-6550
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
EUVD-2020-15958
Malware in sbrugna...
EUVD-2018-2188
Malware in sbrugna...
EUVD-2018-2197
Malware in sbrugna...
EUVD-2018-3505
Malware in sbrugna...