Monstra Monstra vulnerabilities

• monstra cms Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin.... CVE-2025-69906 Public exploit 8.8 HighFebruary 5, 2026
• monstra, monstra cms +1 more A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute... CVE-2024-36773 4.8 MediumJune 7, 2024
• monstra, monstra cms +1 more A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute... CVE-2024-36775 5.4 MediumJune 6, 2024
• monstra, monstra cms +1 more An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute... CVE-2024-36774 Public exploit 7.2 HighJune 6, 2024
• monstra Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload... CVE-2021-40940 9.8 CriticalJune 15, 2022
• monstra A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action... CVE-2021-36548 9.8 CriticalOctober 28, 2021
• monstra cms An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via... CVE-2020-20691 6.5 MediumSeptember 27, 2021
• monstra cms Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. CVE-2020-23697 5.4 MediumJuly 6, 2021
• monstra cms Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into... CVE-2020-23219 8.8 HighJuly 1, 2021
• monstra cms A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers... CVE-2020-23205 5.4 MediumJuly 1, 2021
• monstra A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4... CVE-2020-25414 9.8 CriticalJune 17, 2021
• monstra cms ** DISPUTED ** Monstra CMS 3.0.4 allows an attacker, who already has administrative access to... CVE-2020-13978 Disputed 7.2 HighJune 9, 2020
• monstra Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via... CVE-2020-13384 8.8 HighMay 22, 2020
• monstra Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts... CVE-2020-8439 6.5 MediumMarch 7, 2020
• monstra cms Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager... CVE-2018-19599 5.4 MediumMarch 2, 2020
• monstra cms Monstra CMS before 3.0.4 has XSS via index.php. CVE-2018-11227 6.1 MediumJuly 3, 2019
• monstra Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file... CVE-2018-17418 Public exploit 7.2 HighMarch 7, 2019
• monstra admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators... CVE-2018-18694 4.8 MediumOctober 26, 2018
• monstra admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path... CVE-2018-16820 7.5 HighSeptember 18, 2018
• monstra admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path... CVE-2018-16819 4.9 MediumSeptember 18, 2018
• monstra admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page... CVE-2018-17026 4.8 MediumSeptember 13, 2018
• monstra admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page... CVE-2018-17025 6.1 MediumSeptember 13, 2018
• monstra admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page... CVE-2018-17024 4.8 MediumSeptember 13, 2018
• monstra Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg... CVE-2018-16979 6.1 MediumSeptember 12, 2018
• monstra Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password... CVE-2018-16978 6.1 MediumSeptember 12, 2018
• monstra Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN)... CVE-2018-16977 5.3 MediumSeptember 12, 2018
• monstra In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the... CVE-2018-16608 8.8 HighSeptember 10, 2018
• monstra Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the... CVE-2018-15886 7.2 HighSeptember 10, 2018
• monstra Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers... CVE-2018-14922 6.1 MediumAugust 14, 2018
• monstra cms plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via... CVE-2018-11678 9.8 CriticalJune 5, 2018
• monstra Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1... CVE-2018-11475 8.0 HighMay 25, 2018
• monstra Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at... CVE-2018-11474 8.0 HighMay 25, 2018
• monstra Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users... CVE-2018-11473 6.1 MediumMay 25, 2018
• monstra Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php). CVE-2018-11472 6.1 MediumMay 25, 2018
• monstra plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an... CVE-2018-10121 4.8 MediumApril 15, 2018
• monstra Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin... CVE-2018-10118 Public exploit 4.8 MediumApril 15, 2018
• monstra Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role,... CVE-2018-10109 Public exploit 4.8 MediumApril 14, 2018
• monstra Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager... CVE-2018-9038 Public exploit 6.5 MediumApril 10, 2018
• monstra Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which... CVE-2018-9037 8.8 HighApril 10, 2018
• monstra Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via... CVE-2018-6550 5.4 MediumFebruary 2, 2018
• monstra Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and... CVE-2018-6383 Public exploit EPSS 13.5% 8.8 HighJanuary 29, 2018
• monstra Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution... CVE-2017-18048 Public exploit EPSS 63.4% 8.8 HighJanuary 23, 2018
• monstra Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted,... CVE-2014-9006 5.0 MediumNovember 20, 2014