CVE-2014-2736: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...

PT-2014-4893

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.2.14 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the session ID PHPSESSID to index.php. Additionally, remote authenticated users can execute...

MODx Blind SQL Injection Vulnerability

MODx versions prior to 2.2.14 suffer from multiple remote blind SQL injection vulnerabilities. Product description: ============ MODX originally MODx is a free, open source content management system and web application framework for publishing content on the world wide web and intranets...

MODX Revolution 2.2.13 (and prior) Blind SQL Injection

Product: MODX Revolution Severity: Critical Versions: 2.0.0–2.2.13 Vulnerability type: SQL Injection Report date: 2014-Mar-10 Fixed date: 2014-Apr-04 Description Multiple vulnerabilities were discovered in MODX Revolution that allow users to inject and manipulate the database. This includes an...

MODx Blind SQL Injection

Product description: ============ MODX originally MODx is a free, open source content management system and web application framework for publishing content on the world wide web and intranets. ============ MODX Revolution Blind SQL Injection CVE-2014-2736 ============ The application is vulnerab...

MODx Context Key SQL注入漏洞

MODx是一个开源的PHP应用框架,可以帮助使用者控制自己的网上内容。 某些未明输入在"modX::initContext"方法中 core/model/modx/modx.class.php被用于SQL查询前未能正确过滤，攻击者可以利用漏洞通过注入任意SQL代码操纵SQL查询。 0 MODx 2.2.13 厂商补丁： MODx ----- MODx 2.2.13版本以修复此漏洞，建议用户下载使用： http://modxcms.com...

CVE-2014-2311

SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-2311

SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-2311

MODX Revolution 2.0.0 is affected by a SQL injection in modx.class.php, exploitable before 2.2.13. Remote attackers can execute arbitrary SQL via unspecified vectors. Connected sources confirm product/version and impact; no remediation details are provided in the documents.

CVE-2014-2311

SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-2311: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2014-4615

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.0.0 through 2.2.12 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For MODX Revolution versions 2.0.0 through 2.2.12, update to version 2.2.13 or later to resolve the...

MODX Revolution 2.X SQL Injection

Product: MODX Revolution Severity: Extremely Critical Versions: 2.0.0–2.2.12 Vulnerability type: SQL Injection Report date: 2014-Mar-5 Fixed date: 2014-Mar-6 Description A vulnerability was discovered in MODX Revolution that allows users to inject and manipulate the database. Attackers could...

CVE-2014-2080

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

CVE-2014-2080

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

CVE-2014-2080

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

CVE-2014-2080

CVE-2014-2080 is a Cross-site scripting (XSS) vulnerability in MODX Revolution’s manager/templates/default/header.tpl. It affects MODX Revolution versions before 2.2.11, allowing remote attackers to inject arbitrary web script or HTML via the "a" parameter to the manager interface. The issue aris...

CVE-2014-2080

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...