CVE-2018-20755

MODX Revolution (through v2.7.0-pl) is vulnerable to Cross-site Scripting (XSS) via the User Photo field. The root cause is improper handling of input in the user photo workflow (e.g., getProfilePhoto-related path) that allows injected scripts to be rendered in a user’s browser context. Exploitat...

CVE-2018-20755

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

CVE-2018-20758

MODX Revolution

CVE-2018-20757: Improper Neutralization of Input During Web Page Generation

MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...

CVE-2018-20758: Improper Neutralization of Input During Web Page Generation

MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...

CVE-2018-20755: Improper Neutralization of Input During Web Page Generation

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

CVE-2018-20756: Improper Neutralization of Input During Web Page Generation

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

MODX CMS < 2.7.1 XSS Vulnerability

MODX CMS is prone to a stored cross-site scripting XSS vulnerability via a Create New Media Source action. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

MODX Revolution < 2.6.4 File Upload

File upload vulnerability in MODX Revolution phpthumb class Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2018-20075)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in MODX Revolution version 2.6.5-pl. A remote attacker can...

CVE-2018-17556

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

CVE-2018-17556

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

CVE-2018-17556

MODX Revolution v2.6.5-pl is affected by a stored XSS vulnerability exposed via the Create New Media Source action. Multiple connected sources (Red Hat PR, CNVD/CVE references, OpenVAS) confirm the issue and describe it as a stored XSS in MODX Revolution, with the CVE entry stating the impact as ...

VulnCheck KEV: CVE-2018-1000207

MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...

CVE-2018-17556: Improper Neutralization of Input During Web Page Generation

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

Modx Revolution Remote Code Execution Vulnerability

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A remote code execution vulnerability exists in Modx Revolution versions prior to 2.6.4, which can be...

Modx Revolution < 2.6.4 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload ...

Modx Revolution 2.6.4 - Remote Code Execution

Modx Revolution 2.6.4 - Remote Code Execution Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx':...

Modx Revolution Remote Code Execution

Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx': 'web', 'cachefilename': '../../payload.php',...

Modx Revolution < 2.6.4 - Remote Code Execution

Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx': 'web', 'cachefilename': '../../payload.php',...