$ cve CVE-2018-9038 JSON

CVE-2018-9038 EXPLOIT

6.5

MEDIUM · CVSS 3.0 · EPSS 9.3% (pctl 95)

Patch early

A public exploit exists.

Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ request.

CVSS	6.5 (MEDIUM, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS	9.3% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-22
On CISA KEV	no
Public exploit	yes
Published	2018-04-10
Last modified	2026-06-17

Vendor	Product
monstra	monstra

Source	Title	Date
exploit-db	Monstra CMS 3.0.4 - Arbitrary Folder Deletion	2018-04-24