CVE-2020-13384

PoC —

CVSS 3.1

8.8 high

EPSS

3%p84

Published

May 22, 2020 (May 22, 2020)

Modified

Jun 17, 2026

Description

Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048.

Vendors: monstra
Products: monstra
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.