399 matches found
PT-2020-13814 · Monstra · Monstra Cms
Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: The issue allows an attacker with administrative access to execute arbitrary OS commands via the Theme Module by visiting the "admin/index.php?id=themes&action=edit chunk" URI. This is achieved by...
Arbitrary File Deletion Vulnerability in Monstra CMS
Monstra is a modern and lightweight content management system. Monstra CMS suffers from an arbitrary file deletion vulnerability that can be exploited by an attacker to delete files under the server...
Code Execution Vulnerability in Monstra
Monstra is a lightweight content management system CMS. A code execution vulnerability exists in Monstra, which can be exploited by an attacker to gain control of a web server...
Monstra CMS Code Issue Vulnerability
Monstra CMS is a lightweight PHP-based content management system MS by Ukrainian software developer Sergey Romanenko. A security vulnerability exists in the index.php script in Monstra CMS version 3.0.4, which originates from the program's failure to properly validate file extensions. The...
CVE-2020-13384
Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...
CVE-2020-13384
Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...
Sql injection
Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...
CVE-2020-13384
Monstra CMS 3.0.4 is affected: remote authenticated users can upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because .php filenames are blocked but .php7 are not; this is related to CVE-2017-18048. The CVE entry CVE-2020-13384 documents this behavior and links to public...
CVE-2020-13384
Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...
Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload Vulnerability
Exploit for php platform in category web applications Exploit Title: Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload Exploit Author: Kishan Lal Choudhary Vendor Homepage: https://monstra.org Software Link: https://bitbucket.org/awilum/monstra/downloads/monstra-3.0.4.zip Version: 3.0.4...
Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload
Exploit Title: Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload Google Dork: N/A Date: 2020-05-18 Exploit Author: Kishan Lal Choudhary Vendor Homepage: https://monstra.org Software Link: https://bitbucket.org/awilum/monstra/downloads/monstra-3.0.4.zip Version: 3.0.4 Tested on: Ubuntu 1...
Monstra Access Control Error Vulnerability
Monstra is a lightweight content management system CMS. An access control error vulnerability exists in Monstra 3.0.4 and earlier versions. A remote attacker can exploit this vulnerability to take over arbitrary user accounts via the modified login parameter of the edit URI...
CVE-2020-8439
Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI...
CVE-2020-8439
Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI...
CVE-2020-8439
Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI...
CVE-2020-8439
CVE-2020-8439 affects Monstra CMS up to 3.0.4. A remote authenticated user can exploit an access‑control flaw in the login parameter used by the edit URI (users/ID/edit) to take over arbitrary user accounts. The impact is account hijacking with authenticated access; exploit details are provided i...
CVE-2018-19599
Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product...
CVE-2018-19599
Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product...