403 matches found
CVE-2018-9038
Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...
CVE-2018-9038
Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...
CVE-2018-9037
Monstra CMS 3.0.4 allows remote code execution via an uploadfile request for a .zip file, which is automatically extracted and may contain .php files...
Cross site request forgery (csrf)
Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...
Remote code execution
Monstra CMS 3.0.4 allows remote code execution via an uploadfile request for a .zip file, which is automatically extracted and may contain .php files...
CVE-2018-9038
Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...
CVE-2018-9037
Monstra CMS 3.0.4 allows remote code execution via an uploadfile request for a .zip file, which is automatically extracted and may contain .php files...
CVE-2018-9037
Monstra CMS 3.0.4 allows remote code execution via an uploadfile request for a .zip file, which is automatically extracted and may contain .php files...
CVE-2018-9037
Monstra CMS 3.0.4 is vulnerable to remote code execution via an upload_file request for a .zip file, which is automatically extracted and may deploy .php files. The underlying flaw allows arbitrary PHP execution when a zip containing PHP payload is uploaded, enabling remote code execution under s...
CVE-2018-9038
Monstra CMS 3.0.4 is affected by a remote file deletion vulnerability: an attacker can issue admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ to delete files/folders. The issue is described across multiple feeds as arbitrary deletion of uploads via the filesmanager path. Some OpenVAS d...
CVE-2018-9038
Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...
File Upload Vulnerability in Monstra CMS Backend "Install New Plugin
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A file upload vulnerability exists in the "Install New Plugin" section of the Monstra CMS backend. The...
Directory override delete vulnerability in Monstra CMS backend filesmanager.admin.php file
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A directory override vulnerability exists in the filesmanager.admin.php file in the backend of Monstra CMS. A...
Monstra CMS 3.0.4 Code Execution
Exploit title : Monstra CMS = SetHandler application/x-httpd-php SetHandler application/x-httpd-php-source Deny access to raw php sources by default To re-enable it's recommended to enable access to the files only in specific virtual host or directory Require all denied Deny access to files witho...
Monstra CMS Cross-Site Scripting Vulnerability
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the 'title' function of the plugins/box/pages/pages.plugin.php...
CVE-2018-6550
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
Design/Logic Flaw
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
CVE-2018-6550
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
CVE-2018-6550
CVE-2018-6550 affects Monstra CMS up to version 3.0.4, where an XSS flaw exists in the title handling of plugins/box/pages/pages.plugin.php that can be triggered via a crafted page title sent to admin/index.php. Public sources consistently describe an XSS in the title function, with potential imp...