Design/Logic Flaw

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...

CVE-2018-17025

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...

CVE-2018-17026

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage&name=error404 action, a different vulnerability than CVE-2018-10121...

CVE-2018-17026

CVE-2018-17026 concerns Monstra CMS 3.0.4, where several sources describe a cross-site scripting vulnerability in admin/index.php via the page_meta_title parameter within the edit_page&name=error404 flow. Red Hat’s entry (RH:CVE-2018-17026) specifies a stored XSS vulnerability when an editor with...

CVE-2018-17025

CVE-2018-17025 affects Monstra CMS 3.0.4. The issue is an XSS in admin/index.php via the page_meta_title parameter in an edit_page action for pages with no special role. Documented impact is XSS; no exploitation details are provided in the sources. CVSS scores listed: CVSS v2 base 4.3 (Medium) an...

CVE-2018-17025

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...

CVE-2018-17024

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...

CVE-2018-17024

Monstra CMS 3.0.4 is vulnerable to cross-site scripting via the page_meta_title parameter in the admin/index.php add_page action (CVE-2018-17024). Connected documents confirm the affected component and vulnerability type; no exploitation or remediation details are provided in the supplied sources.

CVE-2018-16979

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943...

CVE-2018-16978

Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473...

Design/Logic Flaw

Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473...

CVE-2018-16977

Monstra CMS V3.0.4 has an information leakage risk e.g., PATH, DOCUMENTROOT, and SERVERADMIN in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php...

Design/Logic Flaw

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943...

CVE-2018-16978

Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473...

Design/Logic Flaw

Monstra CMS V3.0.4 has an information leakage risk e.g., PATH, DOCUMENTROOT, and SERVERADMIN in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php...

CVE-2018-16979

Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943...

CVE-2018-16977

Monstra CMS V3.0.4 has an information leakage risk e.g., PATH, DOCUMENTROOT, and SERVERADMIN in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php...

CVE-2018-16977

Monstra CMS V3.0.4 has an information leakage risk e.g., PATH, DOCUMENTROOT, and SERVERADMIN in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php...

CVE-2018-16978

Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473...

CVE-2018-16979

CVE-2018-16979 affects Monstra CMS 3.0.4. The Nuclei template and related descriptions confirm an HTTP header injection vulnerability in plugins/captcha/crypt/cryptographp.php cfg parameter, allowing an attacker to craft input that can redirect users to attacker-controlled domains, enable cache p...