Monstra vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-69906 Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin.High 8.8 · Feb 5, 2026
• CVE-2024-36774 An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.High 7.2 · Jun 6, 2024
• CVE-2021-40940 Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability.Critical 9.8 · Jun 15, 2022
• CVE-2021-36548 A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers toCritical 9.8 · Oct 28, 2021
• CVE-2020-23219 Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.High 8.8 · Jul 1, 2021
• CVE-2020-25414 A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code.Critical 9.8 · Jun 17, 2021
• CVE-2020-13978 Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commandHigh 7.2 · Jun 9, 2020
• CVE-2020-13384 Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php fileHigh 8.8 · May 22, 2020
• CVE-2018-17418 Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because pluginHigh 7.2 · Mar 7, 2019
• CVE-2018-16820 admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests.High 7.5 · Sep 18, 2018
• CVE-2018-16608 In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&user_id=1, IHigh 8.8 · Sep 10, 2018
• CVE-2018-15886 Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=edit_snippet&filename=google-anHigh 7.2 · Sep 10, 2018
• CVE-2018-11678 plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie.Critical 9.8 · Jun 5, 2018
• CVE-2018-11475 Monstra CMS 3.0.4 has a Session Management Issue in the Users tab.High 8 · May 25, 2018
• CVE-2018-11474 Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab.High 8 · May 25, 2018
• CVE-2018-9037 Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain .php files.High 8.8 · Apr 10, 2018
• CVE-2018-6383 Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which aHigh 8.8 · Jan 29, 2018
• CVE-2017-18048 Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blockedHigh 8.8 · Jan 23, 2018