CVE-2018-10109

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in the blog catalog.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/monstra-cms/monstra/issues/435Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44502/Exploit, Third Party Advisory, VDB Entry
https://github.com/monstra-cms/monstra/issues/435Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44502/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Apr 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-10117.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "CVE-2018-101104.8D-Link DIR-615 T1 devices allow XSS via the Add User feature.CVE-2018-101117.5An issue was discovered in GEGL through 0.3.32. The render_rectangle function in process/gegl-processor.c has unbounded memory allocation, l CVE-2018-101128.8An issue was discovered in GEGL through 0.3.32. The gegl_tile_backend_swap_constructed function in buffer/gegl-tile-backend-swap.c allows re CVE-2018-101137.5An issue was discovered in GEGL through 0.3.32. The process function in operations/external/ppm-load.c has unbounded memory allocation, lead CVE-2018-101148.8An issue was discovered in GEGL through 0.3.32. The gegl_buffer_iterate_read_simple function in buffer/gegl-buffer-access.c allows remote at CVE-2018-101157.8Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote a CVE-2018-101178.8An issue was discovered in idreamsoft iCMS V7.0.7. There is a CSRF vulnerability that can add an admin account via admincp.php?app=members&d CVE-2018-101184.8Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins CVE-2018-101197.8sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm CVE-2018-10128.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso CVE-2018-101207.8The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validat