Monstra
Vendor:
First CVE: Nov 20, 2014 · Active for 11 years
34
Total CVEs
More Total CVEs than 96% of tracked products
4.9
Avg CVEs / Year
Higher CVE frequency than 87% of tracked products
6.7
Avg CVSS
Higher Avg CVSS than 34% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Monstra over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 20, 2014
11 years ago
Most Recent CVE
Jun 7, 2024
778 days ago
CVE Severity & Scoring
Monstra34 CVEs
59%
32%
9%
All CVEs352,427 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network33 (97.1%)
Unknown1 (2.9%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low33 (97.1%)
High0 (0.0%)
Unknown1 (2.9%)
User Interaction
None16 (47.1%)
Unknown1 (2.9%)
Required17 (50.0%)
Privileges Required
Low11 (32.4%)
High11 (32.4%)
None11 (32.4%)
Unknown1 (2.9%)
Top CVEs
Signals from CVEs in this product scope (34 CVEs).
34 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-18048HIGH Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase | Jan 23, 2018 | 8.8 | 73 | NO | YES |
CVE-2018-6383HIGH Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authent | Jan 29, 2018 | 8.8 | 46 | NO | YES |
CVE-2018-9038MEDIUM Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ request. | Apr 10, 2018 | 6.5 | 36 | NO | YES |
CVE-2021-36548CRITICAL A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary c | Oct 28, 2021 | 9.8 | 31 | NO | NO |
CVE-2020-25414CRITICAL A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code. | Jun 17, 2021 | 9.8 | 31 | NO | NO |
CVE-2018-11473MEDIUM Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration). | May 25, 2018 | 6.1 | 31 | NO | YES |
CVE-2021-40940CRITICAL Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability. | Jun 15, 2022 | 9.8 | 30 | NO | NO |
CVE-2018-16979MEDIUM Monstra CMS V3.0.4 allows HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter, a related issue to CVE-2012-2943. | Sep 12, 2018 | 6.1 | 30 | NO | YES |
CVE-2020-13384HIGH Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked bu | May 22, 2020 | 8.8 | 28 | NO | NO |
CVE-2018-10118MEDIUM Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php. | Apr 16, 2018 | 4.8 | 28 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (34 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
2.9% of CVEs· 96th percentile
Nuclei
2 CVEs
5.9% of CVEs· 97th percentile
ExploitDB
4 CVEs
11.8% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (34 CVEs).
Media Mentions
Signals from CVEs in this product scope (34 CVEs).
Top CNAs Publishing CVEs For Monstra
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.0.4 | 28 | 6.7 | 4.1% | 0 | 6 |