CVE-2018-11473

Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...

CVE-2018-11472

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

CVE-2018-11473

Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...

CVE-2018-11472

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

Design/Logic Flaw

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

Design/Logic Flaw

Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11474

Monstra CMS 3.0.4 is affected by a Session Management Issue in the Administrations Tab (admin/index.php?id=users&action=edit&user_id=1). According to CVE-2018-11474, changing a user password does not invalidate an active session from another browser, enabling an existing session to remain authent...

CVE-2018-11472

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

CVE-2018-11475

Summary : Monstra CMS 3.0.4 is affected by a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser. Impact : a user’s active session remains valid in other browsers after a password change (per the CVE descri...

CVE-2018-11473

Monstra CMS 3.0.4 contains a Cross‑Site Scripting vulnerability in the user registration path (users/registration). The Nuclei template documents that an attacker can inject arbitrary JavaScript in the victim’s browser within the site’s context, potentially leading to cookie theft and session iss...

CVE-2018-11473

Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...

CVE-2018-11472

CVE-2018-11472 concerns Monstra CMS 3.0.4, where the login parameter to admin/index.php is vulnerable to a reflected XSS. The connected sources consistently describe this vector as a reflected XSS during login, with no public details beyond that in the provided materials. CVSS data are present (v...

Monstra CMS 3.0.4 Cross Site Scripting

Exploit Title: Stored XSS at Monstra CMS 3.0.4 Install Page Date: 20.05.2018 Exploit Author: Ismail Tasdelen Vendor Homepage: http://monstra.org/ Software Link: Monstra CMS Version: Monstra CMS 3.0.4 Tested on: Windows 10 / Debian - XAMMP Web Server PoC : https://www.youtube.com/watch?v=AQweKapFz...

Monstra CMS before 3.0.4 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Monstra CMS 3.0.4 - Cross-Site Scripting Exploit Author: Berk Dusunur Vendor Homepage: https://monstra.org Software Link: https://monstra.org Version: before 3.0.4 Tested on: Pardus / Win10 AppServer Proof Of Concept Monstra is ...

Monstra CMS 3.0.4 - Cross-Site Scripting (2)

Monstra CMS 3.0.4 - Cross-Site Scripting 2 Exploit Title: Monstra CMS 3.0.4 - Cross-Site Scripting Date: 2018-05-17 Exploit Author: Berk Dusunur Vendor Homepage: https://monstra.org Software Link: https://monstra.org Version: before 3.0.4 Tested on: Pardus / Win10 AppServer Proof Of Concept Monst...

Monstra CMS Cross Site Scripting

Exploit Title: Monstra CMS 3.0.4 - Cross-Site Scripting Date: 2018-05-17 Exploit Author: Berk Dusunur Vendor Homepage: https://monstra.org Software Link: https://monstra.org Version: before 3.0.4 Tested on: Pardus / Win10 AppServer Proof Of Concept Monstra is a modern and lightweight Content...