Monstra Monstra Cms
9 CVEs affecting Monstra Monstra Cms. Latest disclosed: 2026-02-05. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-11678 | Critical | 9.8 | 2018-06-05 | plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie. |
CVE-2025-69906 | High | 8.8 | 2026-02-05 | Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension valida… |
CVE-2020-23219 | High | 8.8 | 2021-07-01 | Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module. |
CVE-2020-13978 | High | 7.2 | 2020-06-09 | Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS comman… |
CVE-2020-20691 | Medium | 6.5 | 2021-09-27 | An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML fil… |
CVE-2018-11227 | Medium | 6.1 | 2019-07-03 | Monstra CMS 3.0.4 and earlier has XSS via index.php. |
CVE-2020-23697 | Medium | 5.4 | 2021-07-06 | Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. |
CVE-2020-23205 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload… |
CVE-2018-19599 | Medium | 5.4 | 2020-03-02 | Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product. |