CVE-2018-19599

Monstra CMS 1.6 is affected by an XSS vulnerability triggered by uploading an SVG file to the admin/filesmanager uploads path (admin/index.php?id=filesmanager&path=uploads/). Root cause is improper handling/sanitization of SVG content, enabling stored or reflected XSS within the admin UI. The ava...

CVE-2018-11227

Monstra CMS 3.0.4 and earlier has XSS via index.php...

CVE-2018-11227

Monstra CMS 3.0.4 and earlier has XSS via index.php...

Design/Logic Flaw

Monstra CMS 3.0.4 and earlier has XSS via index.php...

CVE-2018-11227

Monstra CMS 3.0.4 and earlier has XSS via index.php...

CVE-2018-11227

Summary (CVE-2018-11227) : Monstra CMS ≤3.0.4 is affected by a Cross‑Site Scripting (XSS) vulnerability via index.php. An attacker can inject arbitrary script in the browser of users visiting the affected site, potentially stealing cookie‑based authentication credentials and enabling further brow...

CVE-2018-17418

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

Code injection

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

CVE-2018-17418

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

CVE-2018-17418

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

CVE-2018-17418

Monstra CMS 3.0.4 is vulnerable to remote code execution via a mixed-case file extension (example 123.PhP) because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbidden_types variable. Affected component is the files manager in the Box plugin; the root cause is improper handlin...

CVE-2018-18694

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

CVE-2018-18694

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

Cross site scripting

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

CVE-2018-18694

Monstra CMS 3.0.4 is affected by CVE-2018-18694. Remote authenticated administrators can trigger a stored XSS via JavaScript content in a file whose name lacks an extension, which is interpreted as text/html in some cases. Affected component: admin/filesmanager path on Monstra CMS. Vulnerability ...

CVE-2018-18694

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

Monstra CMS Information Disclosure Vulnerability (CNVD-2019-03471)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An information disclosure vulnerability exists in the...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2019-03472)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the 'password' parameter of the users/registration page in...

Monstra CMS Arbitrary File Deletion Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4. An attacker can...

Monstra CMS Directory Traversal Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A directory traversal vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4. An...