76 matches found
CVE-2008-7242
Multiple cross-site scripting XSS vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the 1 search, 2 "a," 3 messagesubject, and 4 messagebody parameters to certain pages as reachable from manager/index.php; 5 highlight, 6 id, 7 email...
CVE-2008-7242
CVE-2008-7242: Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allow remote attackers to inject arbitrary web script or HTML via a set of parameters (search, a, messagesubject, messagebody on certain pages; highlight, id, email, name, parent on index.php; doc...
CVE-2008-7243
MODx CMS 0.9.6.1 and 0.9.6.1p1 are affected by a CSRF vulnerability (CVE-2008-7243) that allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. Technical details are limited in the provided documents; the description specifies...
CVE-2008-5939
Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...
CVE-2008-5938
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflectbase parameter...
Remote file inclusion
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflectbase parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...
CVE-2008-5939
Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...
CVE-2008-5939
MODx CMS before 0.9.6.3 is affected by XSS in index.php (and related to username input) allowing remote attackers to inject arbitrary script/HTML. CVE-2008-5942 also notes vectors tied to the preserveUrls function. The original disclosure indicates the id parameter is unlikely affected. Remediati...
CVE-2008-5938
The vulnerability CVE-2008-5938 affects MODx CMS ≤ 0.9.6.2, where PHP remote file inclusion is possible through assets/snippets/reflect/snippet.reflect.php via the reflect_base parameter when magic_quotes_gpc is disabled. This could allow an attacker to execute arbitrary PHP code on the server. C...
MODx CMS <= 0.9.6.2 (RFI/XSS) Multiple Remote Vulnerabilities
No description provided by source. :: The Codes Like A Game Anyone Can Play With It,s :: Title: MODx CMS = 0.9.6.2 Multiple Remote Vulne RFI + XSS Vendor:...
MODx CMS <= 0.9.6.2 (RFI/XSS) Multiple Remote Vulnerabilities
Exploit for unknown platform in category web applications ============================================================= MODx CMS = 0.9.6.2 RFI/XSS Multiple Remote Vulnerabilities ============================================================= :: The Codes Like A Game Anyone Can Play With It,s ::...
MODx CMS 0.9.6.2 - Remote File Inclusion / Cross-Site Scripting
:: The Codes Like A Game Anyone Can Play With It,s :: Title: MODx CMS = 0.9.6.2 Multiple Remote Vulne RFI + XSS Vendor: http://modxcms.com/assets/snippets/filedownload/download.php?path=YnVpbGRz&fileName=modx-0.9.6.2.tar.gz&utmsource=0961p2&utmmedium=web&utmcampaign=download Discover by :...
MODx CMS 0.9.6.2 - Remote File Inclusion Cross-Site Scripting
MODx CMS 0.9.6.2 - Remote File Inclusion Cross-Site Scripting :: The Codes Like A Game Anyone Can Play With It,s :: Title: MODx CMS = 0.9.6.2 Multiple Remote Vulne RFI + XSS Vendor:...
MODX CMS < 0.9.2.2 RFI Vulnerability - Active Check
MODX CMS is prone to a remote file inclusion RFI vulnerability. SPDX-FileCopyrightText: 2008 Justin Seitz Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. MODx CMS: index.php crossite scripting through email parameter...
Vulnerability in MODx CMS
Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в MODx CMS. Уязвимость в скрипте index.php в параметре email. XSS: http://site/index.php?operation=subscribe&id=39&email=3CBODY20onload=alertdocument.cookie3E Уязвима прошлогодняя версия MODx CMS и вполне возможно,...
DSECRG-08-013.txt
Digital Security Research Group DSecRG Advisory DSECRG-08-013 Application: MODx CMS Versions Affected: 0.9.6.1, 0.9.6.1p1 Vendor URL: http://modxcms.com/ Bugs: XSS, SiXSS, stored XSS, Change User Password XSRF Vulnerability. Exploits: YES Reported: 11.01.2008 Vendor response: 11.01.2008 Updated...
[DSECRG-08-013] Modx 0.9.6.1, 0.9.6.1p1 Multiple Security Vulnerabilities
Digital Security Research Group DSecRG Advisory DSECRG-08-013 Application: MODx CMS Versions Affected: 0.9.6.1, 0.9.6.1p1 Vendor URL: http://modxcms.com/ Bugs: XSS, SiXSS, stored XSS, Change User Password XSRF Vulnerability. Exploits: YES Reported: 11.01.2008 Vendor response: 11.01.2008 Updated...
MODx CMS 0.9.6.1 Multiple Remote Vulnerabilities
No description provided by source. WwW.BugReport.ir AmnPardaz Security Research Team Title: MODx CMS Vulnerabilities Vendor: http://modxcms.com Bugs: Source code disclosure, local file inclusion Vulnerable Version: 0.9.6.1 prior versions also may be affected Exploitation: Remote with browser...