Monstra CMS Detection (HTTP)

HTTP based detection of Monstra CMS. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-15388)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the registry of Monstra CMS version 3.0.4, which stems from th...

Design/Logic Flaw

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

Cross site scripting

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11472

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

CVE-2018-11473

Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

Design/Logic Flaw

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11473

Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...

CVE-2018-11472

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

Design/Logic Flaw

Monstra CMS 3.0.4 has XSS in the registration Form i.e., the login parameter to users/registration...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11474

Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&userid=1 does not invalidate a session that is open in a different browser...

CVE-2018-11472

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

CVE-2018-11475

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser...

CVE-2018-11475

Summary : Monstra CMS 3.0.4 is affected by a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser. Impact : a user’s active session remains valid in other browsers after a password change (per the CVE descri...

CVE-2018-11474

Monstra CMS 3.0.4 is affected by a Session Management Issue in the Administrations Tab (admin/index.php?id=users&action=edit&user_id=1). According to CVE-2018-11474, changing a user password does not invalidate an active session from another browser, enabling an existing session to remain authent...

CVE-2018-11473

Monstra CMS 3.0.4 contains a Cross‑Site Scripting vulnerability in the user registration path (users/registration). The Nuclei template documents that an attacker can inject arbitrary JavaScript in the victim’s browser within the site’s context, potentially leading to cookie theft and session iss...