CVE-2018-6383
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 13%
from disclosure to weapon1222 days
Published on NVDJan 29
1st PoC+1222d
exploitation probability
13%top 4% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-18048.
Affected products
n/a · n/apublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/49949unverifiedcve_referencepacketstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.