Critical Security Upgrade Notice for FormIt, Quip and Login

We received a report of a potential vulnerability in FormIt, Quip and Login that could be used to expose system settings including database information. This has been been corrected and new versions have been posted. Upgrading of FormIt, Login and Quip to the latest versions via Package Manager...

MODx login.php 'username' Parameter XSS

The installed version of MODx fails to adequately sanitize input passed to the 'username' parameter in the 'login.php' script before using it to generate dynamic HTML content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a...

MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability

Exploit for php platform in category web applications ===================================================================== MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability ===================================================================== getObject'modUser',array 30: 'use...

MODx REvolution CMS 2.0.4-pl2 - POST injection Cross-Site Scripting

MODx REvolution CMS 2.0.4-pl2 - POST injection Cross-Site Scripting getObject'modUser',array 30: 'username' = $POST'username', 31: ; ... 71: else if !empty$POST'forgotlogin' 72: $c = $modx-newQuery'modUser'; 73: $c-selectarray'modUser.','Profile.email','Profile.fullname'; 74: $...

MODx Revolution CMS Cross Site Scripting

getObject'modUser',array 30: 'username' = $POST'username', 31: ; ... 71: else if !empty$POST'forgotlogin' 72: $c = $modx-newQuery'modUser'; 73: $c-selectarray'modUser.','Profile.email','Profile.fullname'; 74: $c-innerJoin'modUserProfile','Profile'; 75: $c-wherearray 76: '...

MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability

Summary MODx Revolution is a powerful PHP Content Management Framework that plays nicely with custom code and helps you build sites faster and maintain them with ease. With Revolution you'll leverage the best things to come around since MVC and Active Record. Description The MODx Revolution CMS...

MODx REvolution CMS 2.0.4-pl2 - POST injection Cross-Site Scripting

getObject'modUser',array 30: 'username' = $POST'username', 31: ; ... 71: else if !empty$POST'forgotlogin' 72: $c = $modx-newQuery'modUser'; 73: $c-selectarray'modUser.','Profile.email','Profile.fullname'; 74: $c-innerJoin'modUserProfile','Profile'; 75: $c-wherearray...

phpThumb Command-Injection Vulnerability

It has recently come to our attention that phpThumb all versions contains an unpatched vulnerability. The application is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input to the ’fltr’ parameter in the ’phpThumb.php’ script. Attackers can explo...

MODx Revolution 2.0.3 Addresses Pair of Vulnerabilities

The MODx Revolution 2.0.3 release addresses a pair of reported security vulnerabilities with MODx Revolution 2.0.2-pl and possibly earlier releases: Input passed via the "modhash" parameter to manager/index.php is not properly sanitized before being returned to the user and input passed via the...

MODX <= 2.0.2 Multiple Vulnerabilities - Active Check

MODX is prone to a local file include LFI vulnerability and a cross-site scripting XSS vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

MODx Revolution 2.0.2-pl Local File Inclusion

------------------------------------------------------------------------ Software................MODx Revolution 2.0.2-pl Vulnerability...........Local File Inclusion Download................http://modxcms.com Release Date............9/28/2010 Tested On...............Windows Vista + XAMPP...

MODx 2.0.2-pl - '/manager/index.php?modahsh' Cross-Site Scripting

source: https://www.securityfocus.com/bid/43577/info MODx is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the local file-include vulnerability using directory-traversal strin...

MODx manager - '/controllers/default/resource/tvs.php?class_key' Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/43577/info MODx is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the local file-include vulnerability using directory-traversal strin...

MODx 2.0.2-pl - managerindex.php?modahsh Cross-Site Scripting

MODx 2.0.2-pl - managerindex.php?modahsh Cross-Site Scripting source: https://www.securityfocus.com/bid/43577/info MODx is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the...

MODx Revolution 2.0.2-pl Cross Site Request Forgery

img...

MODx manager - controllersdefaultresourcetvs.php?class_key Traversal Local File Inclusion

MODx manager - controllersdefaultresourcetvs.php?classkey Traversal Local File Inclusion source: https://www.securityfocus.com/bid/43577/info MODx is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An...

MODx Revolution 2.0.2-pl Cross Site Scripting

------------------------------------------------------------------------ Software................MODx Revolution 2.0.2-pl Vulnerability...........Reflected Cross-site Scripting Download................http://modxcms.com Release Date............9/28/2010 Tested On...............Windows Vista + XAM...

MODx Installation File XSS Vulnerability

Title: MODx Installation File XSS Vulnerability Vendor: MODx Product: MODx CMF Tested Versions: 1.0.3, 1.0.4 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By: Andrei Rimsa Alvares ===== Description ===== MODx CMF is prone to a XSS vulnerability caused by unsanitized user inp...

MODx CMF 1.0.3 / 1.0.4 Cross Site Scripting

Title: MODx Installation File XSS Vulnerability Vendor: MODx Product: MODx CMF Tested Versions: 1.0.3, 1.0.4 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By: Andrei Rimsa Alvares ===== Description ===== MODx CMF is prone to a XSS vulnerability caused by unsanitized user inp...

MODx CMS 1.0.3 SQL Injection

Vulnerability ID: HTB22414 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinmodxcms.html Product: MODx CMS and Application Framework Vendor: MODx Vulnerable Version: 1.0.3 and Probably Prior Versions Vendor Notification: 28 May 2010 Vulnerability Type: SQL Injection Status: N...