CVE-2018-20758: Improper Neutralization of Input During Web Page Generation

MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...

ModX Open Source CMS Babel 3.0.0 Open Redirection

Exploit Title : ModX Open Source CMS Babel Modules 3.0.0 Open Redirect Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/01/2019 Vendor Homepage : modx.com/extras/package/babel Software Download Link : modx.com/extras/download/?id=584e5c06bc8dd305728b4568...

MODX CMS < 2.7.1 XSS Vulnerability

MODX CMS is prone to a stored cross-site scripting XSS vulnerability via a Create New Media Source action. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

MODX Revolution < 2.6.4 File Upload

File upload vulnerability in MODX Revolution phpthumb class Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2018-20075)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in MODX Revolution version 2.6.5-pl. A remote attacker can...

CVE-2018-17556

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

CVE-2018-17556

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

Cross site scripting

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

CVE-2018-17556

MODX Revolution v2.6.5-pl is affected by a stored XSS vulnerability exposed via the Create New Media Source action. Multiple connected sources (Red Hat PR, CNVD/CVE references, OpenVAS) confirm the issue and describe it as a stored XSS in MODX Revolution, with the CVE entry stating the impact as ...

CVE-2018-17556

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

CVE-2018-17556: Improper Neutralization of Input During Web Page Generation

MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action...

PT-2018-14054

Name of the Vulnerable Software and Affected Versions MODX Revolution version 2.6.5-pl Description The issue allows for stored XSS via a Create New Media Source action. Recommendations For MODX Revolution version 2.6.5-pl, at the moment, there is no information about a newer version that contains...

VulnCheck KEV: CVE-2018-1000207

MODX Revolution version =2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appea...

Modx Revolution Remote Code Execution Vulnerability

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A remote code execution vulnerability exists in Modx Revolution versions prior to 2.6.4, which can be...

Modx Revolution < 2.6.4 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload ...

Modx Revolution Remote Code Execution

Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx': 'web', 'cachefilename': '../../payload.php',...

Modx Revolution 2.6.4 - Remote Code Execution

Modx Revolution 2.6.4 - Remote Code Execution Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx':...

Modx Revolution < 2.6.4 - Remote Code Execution

Exploit Title: Modx Revolution ' if requests.get target + '/connectors/system/phpthumb.php', verify=verify.statuscode != 404: printFore.GREEN + '/connectors/system/phpthumb.php - found' url = target + '/connectors/system/phpthumb.php' payload = 'ctx': 'web', 'cachefilename': '../../payload.php',...

Directory Traversal

MODX Revolution is vulnerable to directory traversal. This is due to a lack of sanitization of file paths in /core/model/modx/modmanagerrequest.class.php which allows an attacker to exploit this vulnerability by adding the ../ characters in the web request via the security/login processor to dele...

MODX Revolution Directory Traversal Vulnerability (CNVD-2018-17478)

MODX Revolution is a collection of easy-to-use content management systems CMS and application frameworks. A directory traversal vulnerability exists in /core/model/modx/modmanagerrequest.class.php in MODX Revolution 2.6.4 and earlier versions. An attacker can exploit the vulnerability by deleting...