Monstra
by Monstra
Source repositories
CVEs (43)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-8439 | Med | 0.42 | 6.5 | 0.02 | Mar 7, 2020 | Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI. | ||
| CVE-2018-17025 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2018 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role. | ||
| CVE-2018-16979 | Med | 0.40 | 6.1 | 0.03 | Sep 12, 2018 | Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943. | ||
| CVE-2018-16978 | Med | 0.40 | 6.1 | 0.01 | Sep 12, 2018 | Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473. | ||
| CVE-2018-14922 | Med | 0.40 | 6.1 | 0.02 | Aug 14, 2018 | Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name field in the edit profile page. | ||
| CVE-2018-11473 | Med | 0.40 | 6.1 | 0.02 | May 25, 2018 | Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration). | ||
| CVE-2018-11472 | Med | 0.40 | 6.1 | 0.01 | May 25, 2018 | Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php). | ||
| CVE-2024-36775 | Med | 0.35 | 5.4 | 0.00 | Jun 6, 2024 | A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page. | ||
| CVE-2020-23697 | Med | 0.35 | 5.4 | 0.02 | Jul 6, 2021 | Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. | ||
| CVE-2020-23205 | Med | 0.35 | 5.4 | 0.01 | Jul 1, 2021 | A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings" module. | ||
| CVE-2018-19599 | Med | 0.35 | 5.4 | 0.01 | Mar 2, 2020 | Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product. | ||
| CVE-2018-16977 | Med | 0.35 | 5.3 | 0.01 | Sep 12, 2018 | Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php. | ||
| CVE-2018-6550 | Med | 0.35 | 5.4 | 0.01 | Feb 2, 2018 | Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php. | ||
| CVE-2018-10118 | Med | 0.34 | 4.8 | 0.03 | Apr 16, 2018 | Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php. | ||
| CVE-2018-10109 | Med | 0.34 | 4.8 | 0.02 | Apr 16, 2018 | Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in the blog catalog. | ||
| CVE-2018-11227 | Med | 0.33 | 6.1 | 0.05 | Jul 3, 2019 | Monstra CMS 3.0.4 and earlier has XSS via index.php. | ||
| CVE-2018-16819 | Med | 0.32 | 4.9 | 0.01 | Sep 18, 2018 | admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests. | ||
| CVE-2024-36773 | Med | 0.31 | 4.8 | 0.00 | Jun 7, 2024 | A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php. | ||
| CVE-2018-18694 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases. | ||
| CVE-2018-17026 | Med | 0.31 | 4.8 | 0.01 | Sep 13, 2018 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121. |
- risk 0.42cvss 6.5epss 0.02
Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI.
- risk 0.40cvss 6.1epss 0.01
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role.
- risk 0.40cvss 6.1epss 0.03
Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943.
- risk 0.40cvss 6.1epss 0.01
Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473.
- risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name field in the edit profile page.
- risk 0.40cvss 6.1epss 0.02
Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
- risk 0.40cvss 6.1epss 0.01
Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php).
- risk 0.35cvss 5.4epss 0.00
A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page.
- risk 0.35cvss 5.4epss 0.02
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings" module.
- risk 0.35cvss 5.4epss 0.01
Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product.
- risk 0.35cvss 5.3epss 0.01
Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php.
- risk 0.35cvss 5.4epss 0.01
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php.
- risk 0.34cvss 4.8epss 0.03
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php.
- risk 0.34cvss 4.8epss 0.02
Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in the blog catalog.
- risk 0.33cvss 6.1epss 0.05
Monstra CMS 3.0.4 and earlier has XSS via index.php.
- risk 0.32cvss 4.9epss 0.01
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests.
- risk 0.31cvss 4.8epss 0.00
A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php.
- risk 0.31cvss 4.8epss 0.01
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.
- risk 0.31cvss 4.8epss 0.01
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121.
Page 2 of 3