CVE-2018-9037

Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain .php files.

• CWE-434

• https://github.com/monstra-cms/monstra/issues/433Exploit, Issue Tracking, Third Party Advisory
• https://www.exploit-db.com/exploits/44621/Third Party Advisory
• https://github.com/monstra-cms/monstra/issues/433Exploit, Issue Tracking, Third Party Advisory
• https://www.exploit-db.com/exploits/44621/Third Party Advisory

Published

Apr 10, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9029An improper input validation vulnerability in CA Privileged …
• CVE-2018-9031The login interface on TNLSoftSolutions Sentry Vision 3.x de…
• CVE-2018-9032An authentication bypass vulnerability on D-Link DIR-850L Wi…9.8
• CVE-2018-9034Cross-site scripting (XSS) vulnerability in lib/interface.ph…
• CVE-2018-9035CSV Injection vulnerability in ExportToCsvUtf8.php of the Co…
• CVE-2018-9036CheckSec Canopy 3.x before 3.0.7 has stored XSS via the Logi…
• CVE-2018-9038Monstra CMS 3.0.4 allows remote attackers to delete files vi…
• CVE-2018-9039In Octopus Deploy 2.0 and later before 2018.3.7, an authenti…
• CVE-2018-9040In Advanced SystemCare Ultimate 11.0.1.58, the driver file (…
• CVE-2018-9041In Advanced SystemCare Ultimate 11.0.1.58, the driver file (…
• CVE-2018-9042In Advanced SystemCare Ultimate 11.0.1.58, the driver file (…
• CVE-2018-9043In Advanced SystemCare Ultimate 11.0.1.58, the driver file (…