Monstra
by Monstra
Source repositories
CVEs (42)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-11227 | Med | 0.40 | 6.1 | 0.05 | Jul 3, 2019 | Monstra CMS 3.0.4 and earlier has XSS via index.php. | ||
| CVE-2018-17025 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2018 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role. | ||
| CVE-2018-16979 | Med | 0.40 | 6.1 | 0.03 | Sep 12, 2018 | Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943. | ||
| CVE-2018-16978 | Med | 0.40 | 6.1 | 0.01 | Sep 12, 2018 | Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473. | ||
| CVE-2018-14922 | Med | 0.40 | 6.1 | 0.02 | Aug 14, 2018 | Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name field in the edit profile page. | ||
| CVE-2018-11473 | Med | 0.40 | 6.1 | 0.02 | May 25, 2018 | Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration). | ||
| CVE-2018-11472 | Med | 0.40 | 6.1 | 0.01 | May 25, 2018 | Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php). | ||
| CVE-2020-23697 | Med | 0.35 | 5.4 | 0.02 | Jul 6, 2021 | Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. | ||
| CVE-2020-23205 | Med | 0.35 | 5.4 | 0.01 | Jul 1, 2021 | A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings" module. | ||
| CVE-2018-19599 | Med | 0.35 | 5.4 | 0.01 | Mar 2, 2020 | Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product. | ||
| CVE-2018-16977 | Med | 0.35 | 5.3 | 0.01 | Sep 12, 2018 | Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php. | ||
| CVE-2018-10118 | Med | 0.34 | 4.8 | 0.03 | Apr 16, 2018 | Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php. | ||
| CVE-2018-10109 | Med | 0.34 | 4.8 | 0.02 | Apr 16, 2018 | Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in the blog catalog. | ||
| CVE-2018-16819 | Med | 0.32 | 4.9 | 0.01 | Sep 18, 2018 | admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests. | ||
| CVE-2024-36773 | Med | 0.31 | 4.8 | 0.00 | Jun 7, 2024 | A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php. | ||
| CVE-2018-18694 | Med | 0.31 | 4.8 | 0.01 | Oct 29, 2018 | admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases. | ||
| CVE-2018-17026 | Med | 0.31 | 4.8 | 0.01 | Sep 13, 2018 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121. | ||
| CVE-2018-17024 | Med | 0.31 | 4.8 | 0.01 | Sep 13, 2018 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page action. | ||
| CVE-2018-10121 | Med | 0.31 | 4.8 | 0.01 | Apr 16, 2018 | plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=edit_page&name=error404 (aka Edit 404 page) action. | ||
| CVE-2025-69906 | 0.00 | — | 0.01 | Feb 5, 2026 | Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can… |
- risk 0.40cvss 6.1epss 0.05
Monstra CMS 3.0.4 and earlier has XSS via index.php.
- risk 0.40cvss 6.1epss 0.01
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role.
- risk 0.40cvss 6.1epss 0.03
Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943.
- risk 0.40cvss 6.1epss 0.01
Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2018-11473.
- risk 0.40cvss 6.1epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name field in the edit profile page.
- risk 0.40cvss 6.1epss 0.02
Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).
- risk 0.40cvss 6.1epss 0.01
Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php).
- risk 0.35cvss 5.4epss 0.02
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings" module.
- risk 0.35cvss 5.4epss 0.01
Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product.
- risk 0.35cvss 5.3epss 0.01
Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/ErrorHandler/Resources/Views/Errors/exception.php.
- risk 0.34cvss 4.8epss 0.03
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php.
- risk 0.34cvss 4.8epss 0.02
Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in the blog catalog.
- risk 0.32cvss 4.9epss 0.01
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests.
- risk 0.31cvss 4.8epss 0.00
A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php.
- risk 0.31cvss 4.8epss 0.01
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.
- risk 0.31cvss 4.8epss 0.01
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121.
- risk 0.31cvss 4.8epss 0.01
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page action.
- risk 0.31cvss 4.8epss 0.01
plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=edit_page&name=error404 (aka Edit 404 page) action.
- CVE-2025-69906Feb 5, 2026risk 0.00cvss —epss 0.01
Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can…
Page 2 of 3