403 matches found
CVE-2018-11678
Monstra CMS 3.0.4 is affected: the plugin file plugins/box/users/users.plugin.php allows a Login Rate Limiting Bypass by manipulating the login_attempts cookie. Root cause: bypasses brute-force protection in the login form. Impact per sources is high; CVSSv3 indicates CRITICAL with network access...
Monstra CMS Detection (HTTP)
HTTP based detection of Monstra CMS. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...
Monstra CMS <= 3.0.4 Multiple Vulnerabilities
Monstra CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-15388)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the registry of Monstra CMS version 3.0.4, which stems from th...
Design/Logic Flaw
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...
Cross site scripting
Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...
CVE-2018-11475
Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...
Design/Logic Flaw
Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...
CVE-2018-11473
Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...
CVE-2018-11472
Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...
CVE-2018-11474
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...
CVE-2018-11473
Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...
CVE-2018-11472
Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...
Design/Logic Flaw
Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...
CVE-2018-11475
Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...
CVE-2018-11474
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...
CVE-2018-11474
Monstra CMS 3.0.4 is affected by a Session Management Issue in the Administrations Tab (admin/index.php?id=users&action=edit&user_id=1). According to CVE-2018-11474, changing a user password does not invalidate an active session from another browser, enabling an existing session to remain authent...
CVE-2018-11475
Summary : Monstra CMS 3.0.4 is affected by a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser. Impact : a user’s active session remains valid in other browsers after a password change (per the CVE descri...
