CVE-2018-20755

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

CVE-2018-20756

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

CVE-2018-20756

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

CVE-2018-20757

MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...

CVE-2018-20758

MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...

Design/Logic Flaw

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

CVE-2018-20757

MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...

CVE-2018-20758

MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...

CVE-2018-20756

MODX Revolution (through v2.7.0-pl) is affected by a cross-site scripting (XSS) vulnerability via a document resource (e.g., pagetitle) that is mishandled during Update or Quick Edit actions, or when viewing manager logs. The issue is documented across multiple sources (NVD and related advisories...

CVE-2018-20756

MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...

CVE-2018-20758

MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...

CVE-2018-20757

MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...

CVE-2018-20755

MODX Revolution (through v2.7.0-pl) is vulnerable to Cross-site Scripting (XSS) via the User Photo field. The root cause is improper handling of input in the user photo workflow (e.g., getProfilePhoto-related path) that allows injected scripts to be rendered in a user’s browser context. Exploitat...

CVE-2018-20757

MODX Revolution (versions up to 2.7.0-pl) is exposed to Cross-site Scripting (XSS) via extended user fields (e.g., Container name or Attribute name). Root cause: XSS in how user-field data is processed, enabling script injection in the browser. Impact is client-side compromise (data integrity/def...

CVE-2018-20758

MODX Revolution

CVE-2018-20755

MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...

ModX Open Source CMS Babel 3.0.0 Open Redirection

Exploit Title : ModX Open Source CMS Babel Modules 3.0.0 Open Redirect Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/01/2019 Vendor Homepage : modx.com/extras/package/babel Software Download Link : modx.com/extras/download/?id=584e5c06bc8dd305728b4568...

MODX CMS < 2.7.1 XSS Vulnerability

MODX CMS is prone to a stored cross-site scripting XSS vulnerability via a Create New Media Source action. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

MODX Revolution < 2.6.4 File Upload

File upload vulnerability in MODX Revolution phpthumb class Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2018-20075)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in MODX Revolution version 2.6.5-pl. A remote attacker can...