CVE-2018-1000208

MODX Revolution version =2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files. This attack appear to be exploitable via web request via security/login processor. This vulnerability appears to have been fixed in pull 139...

CVE-2018-1000207

MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...

Revolution 2.6.4 and Prior Two Cricital Vulnerabilities; Upgrade Mandatory/Patch

Product: MODX Revolution Severity: Critical Versions: =2.6.4 Vulnerability types: Remote Execution / File/Directory Deletion Report date: 2018-Jul-11 Fixed date: 2018-Jul-12 Description On July 11 we received notice that there are two critical vulnerabilities that include remote script execution...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2018-13269)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in MODX Revolution version 2.6.3. A remote attacker can...

MODX Revolution CMS <= 2.6.3 Stored XSS Vulnerability

MODX CMS is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site scripting

MODX Revolution 2.6.3 has XSS...

CVE-2018-10382

MODX Revolution 2.6.3 has XSS...

CVE-2018-10382

MODX Revolution 2.6.3 has XSS...

CVE-2018-10382

CVE-2018-10382 affects MODX Revolution 2.6.3 and is described as a cross-site scripting (XSS) vulnerability. Connected sources (CNVD, NVD, OSV/OpenVAS) confirm the affected version and the existence of XSS, but do not provide concrete exploitation details, payloads, or official remediation steps ...

CVE-2018-10382

MODX Revolution 2.6.3 has XSS...

shop.u-plast.by XSS vulnerability

Open Bug Bounty ID: OBB-570146 Description| Value ---|--- Affected Website:| shop.u-plast.by Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Modx CMS Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

MODX Revolution CMS Cross-Site Scripting Vulnerability

MODX Revolution CMS is a new generation of Web2.0 open source content management system CMS of the U.S. company MODX. The system supports online collaboration , search engine optimization SEO, add-ons and so on. A cross-site scripting vulnerability exists in MODX Revolution CMS 2.5.6 and earlier...

MODX CMS 2.x < 2.5.7 XSS Vulnerability

MODX CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:modx:revolution"; ...

CVE-2017-1000223

A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...

Design/Logic Flaw

A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...

CVE-2017-1000223

A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...

CVE-2017-1000223

MODX Revolution CMS

CVE-2017-1000223

A stored web content injection vulnerability WCI, a.k.a XSS is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an...

MODX Revolution Cross-Site Scripting Vulnerability

MODX Revolution is a collection of easy-to-use content management systems CMS and application frameworks. A cross-site scripting vulnerability exists in login-fsp.html in MODX Revolution, which can be exploited by remote attackers to inject arbitrary web script or HTML via QUERYSTRING...

Cross site scripting

Cross-site scripting XSS vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING...