Monstra

Records43All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

Monstra records in CISA KEV

No Monstra vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Monstra 34 records HIGH Monstra Cms 9 records HIGH

Records

9 records in Monstra Cms · all components

TI-2025-42952 CVE-2025-69906 · GHSA-gcf9-q9xj-jjx5

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager…

HIGH 73

Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00755 Published 2026-02-05 No fix listed CWE-434

TI-2020-10951 CVE-2020-13978 · GHSA-2cfh-cfhm-pm58

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify…

HIGH 65

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=th…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01272 Published 2020-06-09 No fix listed CWE-78

TI-2018-08345 CVE-2018-11678 · GHSA-xpj8-p66v-3v8x

plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass…

MEDIUM 45

plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01652 Published 2018-06-05 No fix listed CWE-20

TI-2020-14490 CVE-2020-23219 · GHSA-r99v-5qp5-2g28

Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload…

MEDIUM 41

Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0158 Published 2021-07-01 No fix listed CWE-94

TI-2018-07989 CVE-2018-11227 · GHSA-2cp2-mh5j-4jc9

Monstra CMS 3.0.4 and earlier has XSS via index.php.

LOW 35

Monstra CMS 3.0.4 and earlier has XSS via index.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.04733 Published 2019-07-03 No fix listed CWE-79

TI-2020-13908 CVE-2020-20691 · GHSA-2648-mr6g-p443

An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML…

LOW 31

An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00926 Published 2021-09-27 No fix listed CWE-434

TI-2020-14643 CVE-2020-23697 · GHSA-9r6c-7f3j-3grq

Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.

LOW 28

Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01877 Published 2021-07-06 No fix listed CWE-79

TI-2018-13893 CVE-2018-19599 · GHSA-2279-4crg-c8c8

Monstra CMS 1.6 allows XSS via an uploaded SVG document to the…

LOW 26

Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00728 Published 2020-03-02 No fix listed CWE-79

TI-2020-14484 CVE-2020-23205 · GHSA-62mr-22qr-vwm9

A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows…

LOW 25

A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings"…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00531 Published 2021-07-01 No fix listed CWE-79

Open these records in search →