CVE-2018-10118

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/monstra-cms/monstra/issues/436Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44855/Exploit, Third Party Advisory, VDB Entry
https://github.com/monstra-cms/monstra/issues/436Exploit, Third Party Advisory
https://www.exploit-db.com/exploits/44855/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Apr 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-101197.8sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm CVE-2018-10128.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso CVE-2018-101207.8The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validat CVE-2018-101214.8plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and en CVE-2018-101227.5QingDao Nature Easy Soft Chanzhi Enterprise Portal System (aka chanzhieps) pro1.6 allows remote attackers to read arbitrary files via direct CVE-2018-101238.8p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100.CVE-2018-101245.5The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, CVE-2018-101256.1Contao before 4.5.7 has XSS in the system log.CVE-2018-101266.5ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_f CVE-2018-101278.8An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account w CVE-2018-101286.1An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php.CVE-2018-10138.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microso