CVE-2018-20757

MODX Revolution (versions up to 2.7.0-pl) is exposed to Cross-site Scripting (XSS) via extended user fields (e.g., Container name or Attribute name). Root cause: XSS in how user-field data is processed, enabling script injection in the browser. Impact is client-side compromise (data integrity/def...

CVE-2018-20757

MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...

CVE-2018-20757: Improper Neutralization of Input During Web Page Generation

MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...

CVE-2018-20758: Improper Neutralization of Input During Web Page Generation

MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...

CVE-2018-20755: Improper Neutralization of Input During Web Page Generation

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

CVE-2018-20756: Improper Neutralization of Input During Web Page Generation

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

ModX Open Source CMS Babel 3.0.0 Open Redirection

Exploit Title : ModX Open Source CMS Babel Modules 3.0.0 Open Redirect Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/01/2019 Vendor Homepage : modx.com/extras/package/babel Software Download Link : modx.com/extras/download/?id=584e5c06bc8dd305728b4568...

MODX CMS < 2.7.1 XSS Vulnerability

MODX CMS is prone to a stored cross-site scripting XSS vulnerability via a Create New Media Source action. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

MODX Revolution < 2.6.4 File Upload

File upload vulnerability in MODX Revolution phpthumb class Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2018-20075)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in MODX Revolution version 2.6.5-pl. A remote attacker can...

CVE-2018-17556

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

CVE-2018-17556

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

Cross site scripting

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

CVE-2018-17556

MODX Revolution v2.6.5-pl is affected by a stored XSS vulnerability exposed via the Create New Media Source action. Multiple connected sources (Red Hat PR, CNVD/CVE references, OpenVAS) confirm the issue and describe it as a stored XSS in MODX Revolution, with the CVE entry stating the impact as ...

CVE-2018-17556: Improper Neutralization of Input During Web Page Generation

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

VulnCheck KEV: CVE-2018-1000207

MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...

Modx Revolution Remote Code Execution Vulnerability

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A remote code execution vulnerability exists in Modx Revolution versions prior to 2.6.4, which can be...

Modx Revolution < 2.6.4 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload ...

Modx Revolution 2.6.4 - Remote Code Execution

Modx Revolution 2.6.4 - Remote Code Execution Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx':...

Modx Revolution Remote Code Execution

Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx': 'web', 'cachefilename': '../../payload.php',...