CVE-2017-9067: Improper Limitation of a Pathname to a Restricted Directory

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

CVE-2017-9070: Improper Neutralization of Input During Web Page Generation

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9068: Improper Neutralization of Input During Web Page Generation

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...

PT-2017-18686

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description The issue allows a user with resource edit permissions to inject an XSS payload into the title of any post via the "connectors/index.php" endpoint, specifically through the pagetitle paramete...

PT-2017-18685

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description A user with file upload permissions can execute arbitrary code by uploading a file named .htaccess. Recommendations For MODX Revolution versions prior to 2.5.7, update to version 2.5.7 or lat...

PT-2017-18687

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description The issue allows an attacker to potentially trigger XSS by injecting a payload into the HTTP Host header of a request. This is only exploitable in conjunction with other issues, such as Cache...

PT-2017-18683

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description The issue arises from insufficient validation of the action parameter to the "setup/index.php" endpoint, allowing an attacker to include and execute arbitrary files on the web server due to...

PT-2017-18684

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description The issue allows an attacker to trigger Reflected XSS by injecting payloads into several fields on the setup page, such as the database type parameter. Recommendations For MODX Revolution...

MODX CMS 2.x < 2.5.7 Multiple Vulnerabilities

MODX CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:modx:revolution"; if description...

MODX Revolution SQL Injection Vulnerability

MODx is an open source PHP application framework that helps users control their online content. A SQL injection vulnerability exists in MODX Revolution versions 2.0.1-pl through 2.5.6-pl. An attacker can exploit the vulnerability to inject or manipulate SQL queries in the back-end database,...

MODX Revolution 2.5.6 SQL Injection

MODX Revolution 2.0.1-pl - 2.5.6-pl blind SQLi Information =========== Name: MODX Revolution 2.0.1 - 2.5.6 based on git commit Software: MODX CMS Homepage: https://modx.com Vulnerability: blind SQL injection Prerequisites: attacker needs to be authenticated and with correct permissions Severity:...

MODX Revolution Directory Traversal Vulnerability (CNVD-2017-06899)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in MODX Revolution version 2.5.7. The vulnerability arises du...

CVE-2017-8115

Directory traversal in setup/processors/urlsearch.php aka the search page of an unused processor in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information...

Directory traversal

Directory traversal in setup/processors/urlsearch.php aka the search page of an unused processor in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information...

CVE-2017-8115

Directory traversal in setup/processors/urlsearch.php aka the search page of an unused processor in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information...

CVE-2017-8115

CVE-2017-8115 : Directory traversal in MODX Revolution 2.5.7’s setup/processors/url_search.php (the search page of an unused processor) could allow remote attackers to obtain system directory information. The description in the core CVE record matches multiple connected sources (NVD, Red Hat advi...

CVE-2017-8115

Directory traversal in setup/processors/urlsearch.php aka the search page of an unused processor in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information...

CVE-2017-8115

Directory traversal in setup/processors/urlsearch.php aka the search page of an unused processor in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information...

PT-2017-18125

Name of the Vulnerable Software and Affected Versions MODX Revolution version 2.5.7 Description The issue allows remote attackers to obtain system directory information due to directory traversal in the setup/processors/url search.php file, also known as the search page of an unused processor...

CVE-2017-8115: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in setup/processors/urlsearch.php aka the search page of an unused processor in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information...