717 matches found
Design/Logic Flaw
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...
CVE-2018-20755
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
CVE-2018-20757
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...
CVE-2018-20755
MODX Revolution (through v2.7.0-pl) is vulnerable to Cross-site Scripting (XSS) via the User Photo field. The root cause is improper handling of input in the user photo workflow (e.g., getProfilePhoto-related path) that allows injected scripts to be rendered in a user’s browser context. Exploitat...
CVE-2018-20756
MODX Revolution (through v2.7.0-pl) is affected by a cross-site scripting (XSS) vulnerability via a document resource (e.g., pagetitle) that is mishandled during Update or Quick Edit actions, or when viewing manager logs. The issue is documented across multiple sources (NVD and related advisories...
CVE-2018-20757
MODX Revolution (versions up to 2.7.0-pl) is exposed to Cross-site Scripting (XSS) via extended user fields (e.g., Container name or Attribute name). Root cause: XSS in how user-field data is processed, enabling script injection in the browser. Impact is client-side compromise (data integrity/def...
CVE-2018-20755
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
CVE-2018-20758
MODX Revolution
CVE-2018-20758
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...
CVE-2018-20756
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...
CVE-2018-20757
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...
CVE-2018-20756
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...
CVE-2018-20758
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...
PT-2019-10205
Name of the Vulnerable Software and Affected Versions: MODX Revolution versions prior to v2.7.0-pl Description: The issue allows for XSS attacks via an extended user field, such as Container name or Attribute name. Recommendations: For MODX Revolution versions prior to v2.7.0-pl, update to a...
PT-2019-10204
Name of the Vulnerable Software and Affected Versions: MODX Revolution versions prior to v2.8.0, specifically versions through v2.7.0-pl Description: The issue allows for XSS attacks via a document resource, such as pagetitle, which is mishandled during certain actions like Update, Quick Edit, or...
PT-2019-10203
Name of the Vulnerable Software and Affected Versions: MODX Revolution versions prior to v2.7.0-pl Description: The issue allows for XSS attacks via the User Photo field. Recommendations: For MODX Revolution versions prior to v2.7.0-pl, update to a version that contains a fix for this issue...
CVE-2018-20756: Improper Neutralization of Input During Web Page Generation
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...
CVE-2018-20757: Improper Neutralization of Input During Web Page Generation
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...
CVE-2018-20755: Improper Neutralization of Input During Web Page Generation
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
PT-2019-10206
Name of the Vulnerable Software and Affected Versions: MODX Revolution versions prior to v2.7.0-pl Description: The issue allows for XSS attacks via User Settings, such as the Description field. Recommendations: For MODX Revolution versions prior to v2.7.0-pl, update to a version that contains a...