High severity7.2NVD Advisory· Published Jun 9, 2020· Updated Jun 17, 2026
CVE-2020-13978
CVE-2020-13978
Description
Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=edit_chunk URI. NOTE: there is no indication that the Edit Chunk feature was intended to prevent an administrator from using PHP's exec feature
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Monstra CMS/Monstra CMSdescription
Patches
Vulnerability mechanics
References
1- github.com/monstra-cms/monstra/issues/464nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.