401 matches found
Monstra CMS Directory Traversal Vulnerability
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A directory traversal vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4. An...
Monstra CMS Arbitrary File Deletion Vulnerability
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4. An attacker can...
CVE-2018-16820
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests...
CVE-2018-16819
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...
CVE-2018-16820
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests...
CVE-2018-16819
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...
Arbitrary file deletion
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...
Design/Logic Flaw
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests...
CVE-2018-16819
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...
CVE-2018-16820
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests...
CVE-2018-16820
Monstra CMS 3.0.4 is affected by a directory-traversal in admin/index.php, exploitable via id=filesmanager&path=uploads/… requests to list arbitrary directories. Root cause is improper handling of the path parameter that enables traversal. Impact per NVD: High (CVSSv3 7.5) for confidentiality los...
CVE-2018-16819
Summary : CVE-2018-16819 affects Monstra CMS 3.0.4. The admin/index.php endpoint allows arbitrary file deletion via crafted parameters (id=filesmanager&path=uploads/…&delete_file=). The vulnerability is described across multiple sources as an arbitrary file deletion flaw in Monstra CMS 3.0.4. Aff...
Monstra CMS HTTP Header Injection Vulnerability
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. An HTTP header injection vulnerability exists in the 'cfg' parameter of the...
Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2019-03473)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4, which c...
Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2019-03469)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4, which c...
CVE-2018-17025
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...
CVE-2018-17024
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...
CVE-2018-17024
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...