Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2018-10118: Monstra CMS Stored XSS in Page Creation
CVE-2018-10118 · published 8 years ago
Summary
A stored cross-site scripting (XSS) vulnerability exists in Monstra CMS 3.0.4, allowing attackers to inject malicious code into the system through the page name field when creating a new page. This could lead to unauthorized actions or data theft. Update to the latest version to mitigate this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| monstra | monstra |
3.0.4 cpe:2.3:a:monstra:monstra:3.0.4:*:*:*:*:*:*:* |
Original advisory text
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php.
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php.
References
- https://github.com/monstra-cms/monstra/issues/436 Exploit Third Party Advisory
- https://www.exploit-db.com/exploits/44855/ Exploit Third Party Advisory VDB Entry
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published16 Apr 2018
Updated30 Oct 2026
First seen8 Jul 2026
Track software like this
Free during beta