CVE-2018-9038

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...

Remote code execution

Monstra CMS 3.0.4 allows remote code execution via an uploadfile request for a .zip file, which is automatically extracted and may contain .php files...

CVE-2018-9037

Monstra CMS 3.0.4 allows remote code execution via an uploadfile request for a .zip file, which is automatically extracted and may contain .php files...

CVE-2018-9038

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...

CVE-2018-9037

Monstra CMS 3.0.4 allows remote code execution via an uploadfile request for a .zip file, which is automatically extracted and may contain .php files...

CVE-2018-9038

Monstra CMS 3.0.4 is affected by a remote file deletion vulnerability: an attacker can issue admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ to delete files/folders. The issue is described across multiple feeds as arbitrary deletion of uploads via the filesmanager path. Some OpenVAS d...

CVE-2018-9037

Monstra CMS 3.0.4 is vulnerable to remote code execution via an upload_file request for a .zip file, which is automatically extracted and may deploy .php files. The underlying flaw allows arbitrary PHP execution when a zip containing PHP payload is uploaded, enabling remote code execution under s...

CVE-2018-9038

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&deletedir=./&path=uploads/ request...

Directory override delete vulnerability in Monstra CMS backend filesmanager.admin.php file

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A directory override vulnerability exists in the filesmanager.admin.php file in the backend of Monstra CMS. A...

File Upload Vulnerability in Monstra CMS Backend "Install New Plugin

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A file upload vulnerability exists in the "Install New Plugin" section of the Monstra CMS backend. The...

Monstra CMS 3.0.4 Code Execution

Exploit title : Monstra CMS = SetHandler application/x-httpd-php SetHandler application/x-httpd-php-source Deny access to raw php sources by default To re-enable it's recommended to enable access to the files only in specific virtual host or directory Require all denied Deny access to files witho...

Monstra CMS Cross-Site Scripting Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the 'title' function of the plugins/box/pages/pages.plugin.php...

CVE-2018-6550

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

Design/Logic Flaw

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

CVE-2018-6550

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

CVE-2018-6550

CVE-2018-6550 affects Monstra CMS up to version 3.0.4, where an XSS flaw exists in the title handling of plugins/box/pages/pages.plugin.php that can be triggered via a crafted page title sent to admin/index.php. Public sources consistently describe an XSS in the title function, with potential imp...

CVE-2018-6550

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

Monstra CMS Arbitrary PHP Code Execution Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in Monstra CMS 3.0.4 and earlier versions, which stems from the fact that .ph...

CVE-2018-6383

Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php and similar file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-180...

CVE-2018-6383

Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php and similar file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-180...