Monstra

monstra

43 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (43)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-6383 1Monstra 1Monstra Nov 21, 2024 Jan 29, 2018 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbi...Show more Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-18048.Show less
CVE-2017-18048 1Monstra 1Monstra Nov 21, 2024 Jan 23, 2018 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.
CVE-2014-9006 1Monstra 1Monstra May 6, 2026 Nov 20, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the login_attempts cookie or setting it to cert...Show more Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the login_attempts cookie or setting it to certain values.Show less