588 matches found
CVE-2018-17556
MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...
CVE-2018-17556
MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...
Cross site scripting
MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...
CVE-2018-17556
MODX Revolution v2.6.5-pl is affected by a stored XSS vulnerability exposed via the Create New Media Source action. Multiple connected sources (Red Hat PR, CNVD/CVE references, OpenVAS) confirm the issue and describe it as a stored XSS in MODX Revolution, with the CVE entry stating the impact as ...
VulnCheck KEV: CVE-2018-1000207
MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability...
Modx Revolution Remote Code Execution Vulnerability
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A remote code execution vulnerability exists in Modx Revolution versions prior to 2.6.4, which can be...
Modx Revolution < 2.6.4 - Remote Code Execution Exploit
Exploit for php platform in category web applications Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload ...
Modx Revolution 2.6.4 - Remote Code Execution
Modx Revolution 2.6.4 - Remote Code Execution Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx':...
Modx Revolution Remote Code Execution
Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx': 'web', 'cachefilename': '../../payload.php',...
Modx Revolution < 2.6.4 - Remote Code Execution
Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx': 'web', 'cachefilename': '../../payload.php',...
Directory Traversal
MODX Revolution is vulnerable to directory traversal. This is due to a lack of sanitization of file paths in /core/model/modx/modmanagerrequest.class.php which allows an attacker to exploit this vulnerability by adding the ../ characters in the web request via the security/login processor to dele...
MODX Revolution Directory Traversal Vulnerability (CNVD-2018-17478)
MODX Revolution is a collection of easy-to-use content management systems CMS and application frameworks. A directory traversal vulnerability exists in /core/model/modx/modmanagerrequest.class.php in MODX Revolution 2.6.4 and earlier versions. An attacker can exploit the vulnerability by deleting...
Improper access control
MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...
CVE-2018-1000207
MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...
CVE-2018-1000208
MODX Revolution version =2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files. This attack appear to be exploitable via web request via security/login processor. This vulnerability appears to have been fixed in pull 139...
CVE-2018-1000207
MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...
CVE-2018-1000208
MODX Revolution version =2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files. This attack appear to be exploitable via web request via security/login processor. This vulnerability appears to have been fixed in pull 139...
Directory traversal
MODX Revolution version =2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files. This attack appear to be exploitable via web request via security/login processor. This vulnerability appears to have been fixed in pull 139...