399 matches found
Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-15388)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the registry of Monstra CMS version 3.0.4, which stems from th...
CVE-2018-11475
Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...
Cross site scripting
Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...
CVE-2018-11473
Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...
CVE-2018-11472
Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...
Design/Logic Flaw
Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...
CVE-2018-11474
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...
Design/Logic Flaw
Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...
Design/Logic Flaw
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...
CVE-2018-11474
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...
CVE-2018-11472
Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...
CVE-2018-11475
Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...
CVE-2018-11473
Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...
CVE-2018-11474
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...
CVE-2018-11474
Monstra CMS 3.0.4 is affected by a Session Management Issue in the Administrations Tab (admin/index.php?id=users&action=edit&user_id=1). According to CVE-2018-11474, changing a user password does not invalidate an active session from another browser, enabling an existing session to remain authent...
CVE-2018-11472
CVE-2018-11472 concerns Monstra CMS 3.0.4, where the login parameter to admin/index.php is vulnerable to a reflected XSS. The connected sources consistently describe this vector as a reflected XSS during login, with no public details beyond that in the provided materials. CVSS data are present (v...
CVE-2018-11475
Summary : Monstra CMS 3.0.4 is affected by a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser. Impact : a user’s active session remains valid in other browsers after a password change (per the CVE descri...
CVE-2018-11473
Monstra CMS 3.0.4 contains a Cross‑Site Scripting vulnerability in the user registration path (users/registration). The Nuclei template documents that an attacker can inject arbitrary JavaScript in the victim’s browser within the site’s context, potentially leading to cookie theft and session iss...