Monstra

Monstra

34 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.8

CVE-2024-36773

Exploit
  • EPSS 0.08%
  • Veröffentlicht 07.06.2024 15:15:50
  • Zuletzt bearbeitet 21.11.2024 09:22:36

A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php.

5.4

CVE-2024-36775

Exploit
  • EPSS 0.09%
  • Veröffentlicht 06.06.2024 22:15:10
  • Zuletzt bearbeitet 21.11.2024 09:22:36

A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page.

7.2

CVE-2024-36774

Exploit
  • EPSS 0.04%
  • Veröffentlicht 06.06.2024 22:15:10
  • Zuletzt bearbeitet 21.11.2024 09:22:36

An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.

9.8

CVE-2021-40940

Exploit
  • EPSS 0.98%
  • Veröffentlicht 15.06.2022 17:15:08
  • Zuletzt bearbeitet 21.11.2024 06:25:07

Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability.

9.8

CVE-2021-36548

Exploit
  • EPSS 17.75%
  • Veröffentlicht 28.10.2021 20:15:07
  • Zuletzt bearbeitet 21.11.2024 06:13:49

A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file.

9.8

CVE-2020-25414

Exploit
  • EPSS 1.57%
  • Veröffentlicht 17.06.2021 15:15:07
  • Zuletzt bearbeitet 21.11.2024 05:17:58

A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code.

8.8

CVE-2020-13384

Exploit
  • EPSS 0.74%
  • Veröffentlicht 22.05.2020 05:15:11
  • Zuletzt bearbeitet 21.11.2024 05:01:09

Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048.

6.5

CVE-2020-8439

Exploit
  • EPSS 0.65%
  • Veröffentlicht 07.03.2020 01:15:15
  • Zuletzt bearbeitet 21.11.2024 05:38:51

Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI.

7.2

CVE-2018-17418

Exploit
  • EPSS 14.5%
  • Veröffentlicht 07.03.2019 23:29:00
  • Zuletzt bearbeitet 21.11.2024 03:54:22

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbidden_types variable.

4.8

CVE-2018-18694

Exploit
  • EPSS 0.18%
  • Veröffentlicht 29.10.2018 12:29:04
  • Zuletzt bearbeitet 21.11.2024 03:56:23

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.