CVE-2025-69906 | High | 8.8 | 2026-02-05 | Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension valida… |
CVE-2024-36773 | Medium | 4.8 | 2024-06-07 | A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2024-36775 | Medium | 5.4 | 2024-06-06 | A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2024-36774 | High | 7.2 | 2024-06-06 | An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file. |
CVE-2021-40940 | Critical | 9.8 | 2022-06-15 | Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability. |
CVE-2021-36548 | Critical | 9.8 | 2021-10-28 | A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers t… |
CVE-2020-20691 | Medium | 6.5 | 2021-09-27 | An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML fil… |
CVE-2020-23697 | Medium | 5.4 | 2021-07-06 | Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. |
CVE-2020-23219 | High | 8.8 | 2021-07-01 | Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module. |
CVE-2020-23205 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload… |
CVE-2020-25414 | Critical | 9.8 | 2021-06-17 | A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code. |
CVE-2020-13978 | High | 7.2 | 2020-06-09 | Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS comman… |
CVE-2020-13384 | High | 8.8 | 2020-05-22 | Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php fil… |
CVE-2020-8439 | Medium | 6.5 | 2020-03-07 | Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated… |
CVE-2018-19599 | Medium | 5.4 | 2020-03-02 | Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product. |
CVE-2018-11227 | Medium | 6.1 | 2019-07-03 | Monstra CMS 3.0.4 and earlier has XSS via index.php. |
CVE-2018-17418 | High | 7.2 | 2019-03-07 | Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugi… |
CVE-2018-18694 | Medium | 4.8 | 2018-10-29 | admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose na… |
CVE-2018-16820 | High | 7.5 | 2018-09-18 | admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests. |
CVE-2018-16819 | Medium | 4.9 | 2018-09-18 | admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests. |
CVE-2018-17026 | Medium | 4.8 | 2018-09-13 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018… |
CVE-2018-17025 | Medium | 6.1 | 2018-09-13 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role. |
CVE-2018-17024 | Medium | 4.8 | 2018-09-13 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page action. |
CVE-2018-16979 | Medium | 6.1 | 2018-09-12 | Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943. |
CVE-2018-16978 | Medium | 6.1 | 2018-09-12 | Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration, a different vulnerability than CVE-2… |
CVE-2018-16977 | Medium | 5.3 | 2018-09-12 | Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/ErrorHandler/Resources/Views/Errors/except… |
CVE-2018-16608 | High | 8.8 | 2018-09-10 | In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1… |
CVE-2018-15886 | High | 7.2 | 2018-09-10 | Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=edit_snippet&filename=google-a… |
CVE-2018-14922 | Medium | 6.1 | 2018-08-14 | Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) first name o… |
CVE-2018-11678 | Critical | 9.8 | 2018-06-05 | plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie. |
CVE-2018-11475 | High | 8.0 | 2018-05-25 | Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different… |
CVE-2018-11474 | High | 8.0 | 2018-05-25 | Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&user_id=1 does not inval… |
CVE-2018-11473 | Medium | 6.1 | 2018-05-25 | Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration). |
CVE-2018-11472 | Medium | 6.1 | 2018-05-25 | Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php). |
CVE-2018-10121 | Medium | 4.8 | 2018-04-16 | plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in… |
CVE-2018-10118 | Medium | 4.8 | 2018-04-16 | Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.ad… |
CVE-2018-10109 | Medium | 4.8 | 2018-04-16 | Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in… |
CVE-2018-9038 | Medium | 6.5 | 2018-04-10 | Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ request. |
CVE-2018-9037 | High | 8.8 | 2018-04-10 | Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain .php files. |
CVE-2018-6550 | Medium | 5.4 | 2018-02-02 | Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php. |
CVE-2018-6383 | High | 8.8 | 2018-01-29 | Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which… |
CVE-2017-18048 | High | 8.8 | 2018-01-23 | Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocke… |
CVE-2014-9006 | | | 2014-11-20 | Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attack… |