CVE-2018-11227

Summary (CVE-2018-11227) : Monstra CMS ≤3.0.4 is affected by a Cross‑Site Scripting (XSS) vulnerability via index.php. An attacker can inject arbitrary script in the browser of users visiting the affected site, potentially stealing cookie‑based authentication credentials and enabling further brow...

CVE-2020-23697

Monstra CMS 3.0.4 is affected by a Cross-Site Scripting (XSS) vulnerability in the admin/index.php page (via the page feature). An attacker can inject arbitrary JavaScript that runs in the victim’s browser, potentially stealing session cookies and enabling additional browser-based attacks. This C...

CVE-2020-23219

CVE-2020-23219 affects Monstra CMS 3.0.4. The vulnerability allows a remote attacker to execute arbitrary code by submitting a crafted payload in the Snippet content field under the Edit Snippet module. The provided documents do not specify the underlying root cause, affected variants beyond 3.0....

CVE-2020-23205

CVE-2020-23205 is a stored XSS vulnerability in Monstra CMS 3.0.4 . The flaw allows an attacker to inject and execute arbitrary web scripts or HTML by crafting a payload into the Site Name field in the Site Settings module. Current sources describe the vulnerability as a stored XSS with impact li...

CVE-2018-11678

Monstra CMS 3.0.4 is affected: the plugin file plugins/box/users/users.plugin.php allows a Login Rate Limiting Bypass by manipulating the login_attempts cookie. Root cause: bypasses brute-force protection in the login form. Impact per sources is high; CVSSv3 indicates CRITICAL with network access...

CVE-2020-13978

Monstra CMS 3.0.4 is affected by a command-injection style issue: an attacker with existing administrative access can modify .chunk.php files via the Edit Chunk screen and trigger arbitrary OS commands through the Theme Module by visiting admin/index.php?id=themes&action=edit_chunk. The Red Hat/R...

CVE-2020-20691

Monstra CMS v3.0.4 is reported vulnerable to arbitrary script/HTML execution by bypassing the file-extension filter and uploading crafted HTML files. The CVE-2020-20691 entry notes that an attacker can leverage this to execute web scripts or HTML, without requiring authentication; exact exploit v...

CVE-2018-19599

Monstra CMS 1.6 is affected by an XSS vulnerability triggered by uploading an SVG file to the admin/filesmanager uploads path (admin/index.php?id=filesmanager&path=uploads/). Root cause is improper handling/sanitization of SVG content, enabling stored or reflected XSS within the admin UI. The ava...

CVE-2025-69906

Monstra CMS version 3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin, specifically within plugins/box/filesmanager/filesmanager.admin.php. The root cause is a weak blacklist-based file extension validation that fails to block various bypass techniques, such as cas...