CVE-2020-8439

CVE-2020-8439 affects Monstra CMS up to 3.0.4. A remote authenticated user can exploit an access‑control flaw in the login parameter used by the edit URI (users/ID/edit) to take over arbitrary user accounts. The impact is account hijacking with authenticated access; exploit details are provided i...

CVE-2020-8439

Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI...

CVE-2018-19599

Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product...

Design/Logic Flaw

Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product...

CVE-2018-19599

Monstra CMS 1.6 is affected by an XSS vulnerability triggered by uploading an SVG file to the admin/filesmanager uploads path (admin/index.php?id=filesmanager&path=uploads/). Root cause is improper handling/sanitization of SVG content, enabling stored or reflected XSS within the admin UI. The ava...

CVE-2018-19599

Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product...

CVE-2018-11227

Monstra CMS 3.0.4 and earlier has XSS via index.php...

CVE-2018-11227

Monstra CMS 3.0.4 and earlier has XSS via index.php...

Design/Logic Flaw

Monstra CMS 3.0.4 and earlier has XSS via index.php...

CVE-2018-11227

Summary (CVE-2018-11227) : Monstra CMS ≤3.0.4 is affected by a Cross‑Site Scripting (XSS) vulnerability via index.php. An attacker can inject arbitrary script in the browser of users visiting the affected site, potentially stealing cookie‑based authentication credentials and enabling further brow...

CVE-2018-11227

Monstra CMS 3.0.4 and earlier has XSS via index.php...

CVE-2018-17418

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

Code injection

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

CVE-2018-17418

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

CVE-2018-17418

Monstra CMS 3.0.4 is vulnerable to remote code execution via a mixed-case file extension (example 123.PhP) because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbidden_types variable. Affected component is the files manager in the Box plugin; the root cause is improper handlin...

CVE-2018-17418

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbiddentypes variable...

CVE-2018-18694

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

CVE-2018-18694

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

Cross site scripting

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

CVE-2018-18694

Monstra CMS 3.0.4 is affected by CVE-2018-18694. Remote authenticated administrators can trigger a stored XSS via JavaScript content in a file whose name lacks an extension, which is interpreted as text/html in some cases. Affected component: admin/filesmanager path on Monstra CMS. Vulnerability ...