340 matches found
CVE-2018-14922
Multiple cross-site scripting XSS vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the 1 first name or 2 last name field in the edit profile page...
CVE-2018-14922
Multiple cross-site scripting XSS vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the 1 first name or 2 last name field in the edit profile page...
CVE-2018-14922
Multiple cross-site scripting XSS vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the 1 first name or 2 last name field in the edit profile page...
CVE-2018-14922
CVE-2018-14922 : Monstra CMS 3.0.4 contains multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script or HTML via the first name or last name fields on the profile edit page. The issue is documented across multiple sources (NVD entry and OSVDB/CVE ...
Monstra CMS Authenticated Arbitrary File Upload
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Monstra CMS Authenticated Arbitrary File Upload', 'Description' = %q MonstraCMS 3.0.4 allows users to upload Arbitrary files which leads to remot...
Monstra CMS < 3.0.4 - Cross-Site Scripting Exploit
Exploit for php platform in category web applications Title: Monstra CMS www.target.com' url = input'Target : ' print' Required admin's PHPSESSID.' PHPSESSID = input'PHPSESSID : ' pagename = input'Pagename : ' script = input'Script : ' target = 'http://' + url +...
Monstra CMS 3.0.4 - Cross-Site Scripting (1)
Monstra CMS 3.0.4 - Cross-Site Scripting 1 Title: Monstra CMS www.target.com' url = input'Target : ' print' Required admin's PHPSESSID.' PHPSESSID = input'PHPSESSID : ' pagename = input'Pagename : ' script = input'Script : ' target = 'http://' + url + '/admin/index.php?id=pages&action=addpage'...
Monstra CMS < 3.0.4 - Cross-Site Scripting (1)
Title: Monstra CMS www.target.com' url = input'Target : ' print' Required admin's PHPSESSID.' PHPSESSID = input'PHPSESSID : ' pagename = input'Pagename : ' script = input'Script : ' target = 'http://' + url + '/admin/index.php?id=pages&action=addpage' cookie = 'PHPSESSID':PHPSESSID data =...
Monstra CMS Security Bypass Vulnerability
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in the plugins/box/users/users.plugin.php file in Monstra CMS version 3.0.4. ...
Design/Logic Flaw
plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the loginattempts cookie...
CVE-2018-11678
plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the loginattempts cookie...
CVE-2018-11678
plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the loginattempts cookie...
CVE-2018-11678
plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the loginattempts cookie...
CVE-2018-11678
Monstra CMS 3.0.4 is affected: the plugin file plugins/box/users/users.plugin.php allows a Login Rate Limiting Bypass by manipulating the login_attempts cookie. Root cause: bypasses brute-force protection in the login form. Impact per sources is high; CVSSv3 indicates CRITICAL with network access...
Monstra CMS Detection (HTTP)
HTTP based detection of Monstra CMS. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...
Monstra CMS <= 3.0.4 Multiple Vulnerabilities
Monstra CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Design/Logic Flaw
Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...
Cross site scripting
Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...