GCVE - cpe:2.3:a:monstra:monstra_cms:3.0.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:monstra:monstra_cms:3.0.4:*:*:*:*:*:*:*

part: a version: 3.0.4 update: *

Vendor	Monstra (`f41ec22e-a578-5c2d-b8d6-8f372c112124`)
Product	Monstra Cms (`696f60c5-f70e-5d5c-8a14-bdc4c770dc68`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-69906`	vulnerable	2026-06-08 07:43:13.912256	Details available Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension validation and stores uploaded files directly in a web-accessible directory. Under typical server configurations, this can allow an attacker to upload files that are interpreted as executable code, resulting in remote code execution. Published: 2026-02-05T00:00:00.000Z Updated: 2026-02-06T15:57:50.945Z Open on db.gcve.eu Reference links https://github.com/monstra-cms/monstra/tree/master/plugins/box/filesmanager https://github.com/cypherdavy/CVE-2025-69906-Monstra-CMS-3.0.4-Arbitrary-File-Upload-to-RCE	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-36775`	vulnerable	2026-06-08 06:39:45.650297	Details available A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page. Published: 2024-06-06T21:35:17.060Z Updated: 2025-02-13T15:59:37.232Z Open on db.gcve.eu Reference links https://github.com/OoLs5/VulDiscovery/blob/main/monstra_xss.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-36773`	vulnerable	2026-06-08 06:39:45.643968	Details available A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php. Published: 2024-06-07T14:28:44.156Z Updated: 2025-02-13T15:59:36.183Z Open on db.gcve.eu Reference links https://github.com/OoLs5/VulDiscovery/blob/main/cve-2024-36773.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23697`	vulnerable	2026-06-08 05:22:32.055676	Details available Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. Published: 2021-07-06T20:50:22.000Z Updated: 2024-08-04T15:05:10.367Z Open on db.gcve.eu Reference links https://github.com/monstra-cms/monstra/issues/463	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23219`	vulnerable	2026-06-08 05:22:31.817266	Details available Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module. Published: 2021-07-01T20:40:56.000Z Updated: 2024-08-04T14:58:14.868Z Open on db.gcve.eu Reference links https://github.com/monstra-cms/monstra/issues/466	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23205`	vulnerable	2026-06-08 05:22:31.812539	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-20691`	vulnerable	2026-06-08 05:22:30.511170	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-13978`	vulnerable	2026-06-08 05:18:01.670766	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-11678`	vulnerable	2026-06-08 05:10:38.786728	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.