CVE-2020-25911

A XML External Entity XXE vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service DOS...

CVE-2020-25911: Improper Restriction of XML External Entity Reference

A XML External Entity XXE vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service DOS...

PT-2021-11202 · Modx · Modx Cms

Name of the Vulnerable Software and Affected Versions: MODX CMS version 2.7.3 Description: A XML External Entity XXE vulnerability was discovered in the modRestServiceRequest component which can lead to an information disclosure or denial of service DOS. Recommendations: For MODX CMS version 2.7....

Modx Cms 代码问题漏洞

Modx Cms is the U.S. Modx Corporation, one of the world's fastest, safest, most flexible and scalable open source Cms. A security vulnerability exists in MODX CMS, which originates from errors such as configuration during operation of a networked system or product. An unauthorized attacker could...

About the Security Notices category

This is a sub-categrory of Announcements for Security Notices. Older security notices can be found in the archived MODX Forums here: https://forums.modx.com/board/8/security-notices 1 post - 1 participant Read full topic...

CVE-2019-1010178

Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...

CVE-2019-1010178

Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...

Design/Logic Flaw

Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...

CVE-2019-1010178

CVE-2019-1010178 affects MODX Revolution ≤ 1.0.0-beta4/β5 via the Fred add-on (assets/components/fred/web/elfinder/connector.php). The root cause is Incorrect Access Control (CWE-648), enabling Remote Code Execution. The attack vector involves uploading a PHP file or altering data in the database...

CVE-2019-1010178

Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...

CVE-2019-1010178: Incorrect Use of Privileged APIs

Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

Design/Logic Flaw

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by CWE-434 (Unrestricted Upload of File with Dangerous Type). The issue arises from how user parameters are filtered before passing them into the phpthumb class, enabling an attack via a web request to /assets/components/gallery/connector.php to create fi...

CVE-2019-1010123: Unrestricted Upload of File with Dangerous Type

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

MODX setup/ Directory Site Exploit

There is currently an active exploit of sites with an intact MODX Revolution setup/ directory. This can give anyone on the internet complete access to your site and possibly your server with trivial effort. This directory should never be left in place once a site is installed. You can check if yo...

Cross-site Scripting (XSS)

modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape descriptiontrans filed in modx.grid.settings.js, allowing the attacker to inject arbitrary script through it...

Cross-site Scripting (XSS)

modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize user photo field, allowing the attacker to inject malicious script through it...