717 matches found
CVE-2019-1010123
MODX Revolution Gallery 1.7.0 is affected by CWE-434 (Unrestricted Upload of File with Dangerous Type). The issue arises from how user parameters are filtered before passing them into the phpthumb class, enabling an attack via a web request to /assets/components/gallery/connector.php to create fi...
CVE-2019-1010123
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
PT-2019-11472
Name of the Vulnerable Software and Affected Versions: MODX Revolution Gallery version 1.7.0 Description: The issue allows creating a file with custom filename and content. It involves filtering user parameters before passing them into the phpthumb class. The attack vector is a web request via th...
CVE-2019-1010123: Unrestricted Upload of File with Dangerous Type
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
MODX setup/ Directory Site Exploit
There is currently an active exploit of sites with an intact MODX Revolution setup/ directory. This can give anyone on the internet complete access to your site and possibly your server with trivial effort. This directory should never be left in place once a site is installed. You can check if yo...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape descriptiontrans filed in modx.grid.settings.js, allowing the attacker to inject arbitrary script through it...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize user photo field, allowing the attacker to inject malicious script through it...
Cross-Site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via a document resource such as pagetitle through the update or quick edit action. The Javascript is executed when viewing manager logs...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The vulnerability exists through an extended user field such as Container name or Attribute name, allowing XSS attacks...
Design/Logic Flaw
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
Design/Logic Flaw
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...
Design/Logic Flaw
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...
CVE-2018-20756
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...
CVE-2018-20758
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...
CVE-2018-20757
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...
CVE-2018-20758
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...
CVE-2018-20755
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
CVE-2018-20755
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
CVE-2018-20756
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...
Cross site scripting
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...