MODX Revolution 2.2.13 (and prior) Blind SQL Injection

Product: MODX Revolution Severity: Critical Versions: 2.0.0–2.2.13 Vulnerability type: SQL Injection Report date: 2014-Mar-10 Fixed date: 2014-Apr-04 Description Multiple vulnerabilities were discovered in MODX Revolution that allow users to inject and manipulate the database. This includes an...

CVE-2014-2311

SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-2311

MODX Revolution 2.0.0 is affected by a SQL injection in modx.class.php, exploitable before 2.2.13. Remote attackers can execute arbitrary SQL via unspecified vectors. Connected sources confirm product/version and impact; no remediation details are provided in the documents.

CVE-2014-2311

SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

MODX Revolution 2.X SQL Injection

Product: MODX Revolution Severity: Extremely Critical Versions: 2.0.0–2.2.12 Vulnerability type: SQL Injection Report date: 2014-Mar-5 Fixed date: 2014-Mar-6 Description A vulnerability was discovered in MODX Revolution that allows users to inject and manipulate the database. Attackers could...

CVE-2014-2080

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

CVE-2014-2080

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

CVE-2014-2080

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

CVE-2014-2080

CVE-2014-2080 is a Cross-site scripting (XSS) vulnerability in MODX Revolution’s manager/templates/default/header.tpl. It affects MODX Revolution versions before 2.2.11, allowing remote attackers to inject arbitrary web script or HTML via the "a" parameter to the manager interface. The issue aris...

Security Bypass and Remote Execution

Product: MODX Revolution Severity: Extremely Critical Versions: 2.1.0–2.2.7 Vulnerability type: Security Bypass Report date: 2013-Jun-4 Fixed date: 2013-Jun-4 Description Two vulnerabilities were discovered in MODX that allow users to bypass security. Attackers could exploit this to remotely...

New vulnerabilities in MODx Revolution

Hello 3APA3A! I want to warn you about two new vulnerabilities in MODx Revolution. This is addition to previous publication about vulnerabilities in MODx Revolution http://securityvulns.ru/docs28923.html. These are Abuse of Functionality vulnerabilities in MODx related to earlier mentioned Brute...

BF, CSRF, AoF and IAA vulnerabilities in MODx Revolution

Hello 3APA3A! I want to warn you about multiple vulnerabilities in MODx Revolution. These are Brute Force, Cross-Site Request Forgery, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in MODx. It's about 2.x Revolution versions of MODx. In 0.x and 1.x Evolution versions of...

CVE-2010-5278

Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter. NOTE: some of these details are obtaine...

Directory traversal

Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter. NOTE: some of these details are obtaine...

CVE-2010-5278

MODx Revolution 2.0.2-pl (and possibly earlier) is vulnerable to a Local File Inclusion via the class_key parameter in manager/controllers/default/resource/tvs.php when magic_quotes_gpc is disabled. The vulnerability allows an attacker to read arbitrary server files by使用 a directory traversal seq...

CVE-2010-5278

Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter. NOTE: some of these details are obtaine...

MODx Revolution 2.0.2-pl LFI

Local file include vulnerability in MODx classkey parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

Cross site scripting

Cross-site scripting XSS vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter...