Monstra
Monstra CMS: vulnerabilidades y CVE
Monstra CMS tiene 9 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE9
Últimos 12 meses1
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-69906 | Alta (8.8) | 0.72% | — | 5 feb 2026 | Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible… |
| CVE-2020-20691 | Media (6.5) | 0.93% | — | 27 sept 2021 | An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files. |
| CVE-2020-23697 | Media (5.4) | 1.9% | — | 6 jul 2021 | Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. |
| CVE-2020-23219 | Alta (8.8) | 1.6% | — | 1 jul 2021 | Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module. |
| CVE-2020-23205 | Media (5.4) | 0.53% | — | 1 jul 2021 | A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings"… |
| CVE-2020-13978 | Alta (7.2) | 1.3% | — | 9 jun 2020 | Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the… |
| CVE-2018-19599 | Media (5.4) | 0.73% | — | 2 mar 2020 | Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product. |
| CVE-2018-11227 | Media (6.1) | 4.7% | — | 3 jul 2019 | Monstra CMS 3.0.4 and earlier has XSS via index.php. |
| CVE-2018-11678 | Crítica (9.8) | 1.7% | — | 5 jun 2018 | plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie. |