Product:

Monstra

(Monstra)
Repositories https://github.com/monstra-cms/monstra
#Vulnerabilities 34
Date Id Summary Products Score Patch Annotated
2018-09-18 CVE-2018-16820 admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests. Monstra 7.5
2018-09-18 CVE-2018-16819 admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests. Monstra 4.9
2018-09-10 CVE-2018-16608 In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1, Insecure Direct Object Reference (IDOR). Monstra 8.8
2018-09-10 CVE-2018-15886 Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=edit_snippet&filename=google-analytics URI, which allows attackers to execute arbitrary PHP code by placing this code after a <?php substring. Monstra 7.2
2018-08-14 CVE-2018-14922 Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name field in the edit profile page. Monstra 6.1
2018-05-25 CVE-2018-11475 Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser. Monstra 8.0
2018-05-25 CVE-2018-11474 Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&user_id=1 does not invalidate a session that is open in a different browser. Monstra 8.0
2018-05-25 CVE-2018-11473 Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration). Monstra 6.1
2018-05-25 CVE-2018-11472 Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php). Monstra 6.1
2018-04-16 CVE-2018-10121 plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=edit_page&name=error404 (aka Edit 404 page) action. Monstra 4.8