CVE-2015-6588

Cross-site scripting XSS vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING...

CVE-2015-6588

CVE-2015-6588 affects MODX Revolution with an XSS in login-fsp.html (pre-1.9.1). The underlying issue is that the QUERY_STRING is not properly sanitized, allowing remote attackers to inject arbitrary script/HTML. Practical impact is user interaction is not required, but the attack occurs via craf...

CVE-2015-6588

Cross-site scripting XSS vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERYSTRING...

MODX Revolution SQL Injection Vulnerability (CNVD-2017-30635)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A SQL injection vulnerability exists in MODX Revolution versions 2.x through 2.5.6. A remote attacker ca...

MODX CMS 2.x - 2.6.4 XSS Vulnerability

MODX CMS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:modx:revolution"; ...

MODX Revolution System Settings Module Cross-Site Scripting Vulnerability

MODX Revolution is the United States MODX company's set of PHP-based open source content management system CMS. The system supports online collaboration , search engine optimization SEO, add-ons , etc. System Settings module is one of the system settings module . A cross-site scripting...

Design/Logic Flaw

In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module...

CVE-2017-11744

In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module...

CVE-2017-11744

In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module...

CVE-2017-11744

In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module...

CVE-2017-11744

CVE-2017-11744 affects MODX Revolution 2.5.7. The vulnerability is in the System Settings module where the key and name parameters can be exploited to inject cross-site scripting (XSS). A malicious payload sent to connectors/index.php can be triggered for every user visiting the module, indicatin...

CVE-2017-1000067

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...

CVE-2017-1000067

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...

Sql injection

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...

CVE-2017-1000067

MODX Revolution versions 2.x through 2.5.6 are affected by a blind SQL injection due to improper sanitization in the escape method. This vulnerability can allow an authenticated user to access the database and potentially escalate privileges. No explicit remediation/version patch is provided in t...

CVE-2017-1000067

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...

Arbitrary File Upload Vulnerability in MODX Revolution

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. An arbitrary file upload vulnerability exists in MODX Revolution. The vulnerability is due to improper...

ModX CMS Proof Of Concept Shell Upload

c@kali:/src/Napalm2.2/libs$ cat shell-modxcms.py !/usr/bin/env python shell-modxcms.py - upload shell for modx 2.5.6-pl !! we need rwx in modx-webdir to go ;Z 30.05.217 @ code610 blogspot com import requests import re target=rawinput"Hostname " print '+ Preparing tests for ' + strtarget session =...

MODX Revolution Directory Traversal Vulnerability (CNVD-2017-07464)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in MODX Revolution versions prior to 2.5.7 using PHP version...

MODX Revolution Cross-Site Scripting Vulnerability (CNVD-2017-07466)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A cross-site scripting vulnerability exists in versions of MODX Revolution prior to 2.5.7. A remote...