RSS   Podatności dla 'Monstra'   RSS

2021-10-28
 
CVE-2021-36548

CWE-434
 
 
A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file.

 
2021-06-17
 
CVE-2020-25414

CWE-94
 
 
A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code.

 
2020-05-22
 
CVE-2020-13384

CWE-434
 
 
Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048.

 
2020-03-07
 
CVE-2020-8439

CWE-862
 
 
Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI.

 
2019-03-07
 
CVE-2018-17418

CWE-434
 
 
Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbidden_types variable.

 
2018-10-29
 
CVE-2018-18694

CWE-79
 
 
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.

 
2018-09-18
 
CVE-2018-16820

CWE-22
 
 
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests.

 
 
CVE-2018-16819

CWE-22
 
 
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests.

 
2018-09-13
 
CVE-2018-17026

CWE-79
 
 
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121.

 
 
CVE-2018-17025

CWE-79
 
 
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role.

 

Copyright 2024, cxsecurity.com

 

Back to Top