GCVE - cpe:2.3:a:monstra:monstra:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:monstra:monstra:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Monstra (`f41ec22e-a578-5c2d-b8d6-8f372c112124`)
Product	Monstra (`79283200-1293-5401-bb1b-5d4d4edb4c68`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/monstra-cms/monstra`	purl2cpe	2026-06-01 10:17:12.147505
`pkg:sourceforge/monstra-cms`	purl2cpe	2026-06-01 10:17:12.147508

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-36773`	vulnerable	2026-06-08 06:39:45.646219	Details available A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php. Published: 2024-06-07T14:28:44.156Z Updated: 2025-02-13T15:59:36.183Z Open on db.gcve.eu Reference links https://github.com/OoLs5/VulDiscovery/blob/main/cve-2024-36773.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40940`	vulnerable	2026-06-08 05:35:19.375030	Details available Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability. Published: 2022-06-15T16:28:43.000Z Updated: 2024-08-04T02:59:30.375Z Open on db.gcve.eu Reference links https://github.com/monstra-cms/monstra/issues/471	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-8439`	vulnerable	2026-06-08 05:27:16.532345	Details available Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI. Published: 2020-03-07T00:26:41.000Z Updated: 2024-08-04T09:56:28.424Z Open on db.gcve.eu Reference links http://uploadboy.me/cn40ne6p89t6/POC.mp4.html https://cert.ikiu.ac.ir/public-files/pages/attachments/11/02630f153869936d555a79f89d717f9c.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6550`	vulnerable	2026-06-08 05:11:53.946696	Details available Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php. Published: 2018-02-02T09:00:00.000Z Updated: 2024-09-16T17:38:26.011Z Open on db.gcve.eu Reference links https://github.com/monstra-cms/monstra/commit/388ab412035474068758df6b07e7e06852f3747b https://github.com/monstra-cms/monstra/issues/427	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6383`	vulnerable	2026-06-08 05:11:53.676265	Details available Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-18048. Published: 2018-01-29T18:00:00.000Z Updated: 2024-08-05T06:01:49.168Z Open on db.gcve.eu Reference links https://github.com/monstra-cms/monstra/issues/429 http://packetstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.html https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-6383-Exploit	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9006`	vulnerable	2026-06-08 05:06:10.606675	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.