PT-2011-1818

Name of the Vulnerable Software and Affected Versions MODx Revolution version 2.0.2-pl Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the modhash parameter in the "manager/index.php" endpoint. Recommendations For MODx Revolution...

CVE-2010-4883: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter...

MODx CMS v1.0.x - Multiple Cross Site Vulnerabilities

Document Title: =============== MODx CMS v1.0.x - Multiple Cross Site Vulnerabilities Release Date: ============= 2011-08-02 Vulnerability Laboratory ID VL-ID: ==================================== 125 Product & Service Introduction: =============================== MODx helps you take control of...

MODx CMS v1.0.x - Multiple Cross Site Vulnerabilities

Document Title: =============== MODx CMS v1.0.x - Multiple Cross Site Vulnerabilities Release Date: ============= 2011-08-02 Vulnerability Laboratory ID VL-ID: ==================================== 125 Product & Service Introduction: =============================== MODx helps you take control of...

MODx Revolution 2.0.8-pl Cross Site Request Forgery

Exploit Title: MODx Revolution 2.0.8-pl CMS XSRF Vulnerability Add new user + Author : ^Xecuti0n3r + E-mail : xecuti0n3ryahoo.com + Category : Web Apps XSRF + Demo Link : http://www.cmsagora.com/demo.php?id=50&type=2 + Demo Login: Username: admin Password: demo123...

MODx Revolution 2.0.8-pl CMS XSRF Vulnerability (Add new user)

Exploit for php platform in category web applications + Exploit Title: MODx Revolution 2.0.8-pl CMS XSRF Vulnerability Add new user + Author : ^Xecuti0n3r + E-mail : xecuti0n3ryahoo.com + Category : Web Apps XSRF + Demo Link : http://www.cmsagora.com/demo.php?id=50&type=2 + Demo Login: Username:...

MODx 'ucfg' Parameter Arbitrary File Access

The installed version of MODx allows access to arbitrary files because it fails to perform sufficient validation on 'ucfg' parameter in 'assets/snippets/ajaxSearch/ajaxSearchPopup.php'. By supplying directory traversal strings such as '..%2F' in a specially crafted AjaxSearch 'POST' request, it i...

CVE-2011-0741

Multiple cross-site scripting XSS vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 installer or 2 image editor...

CVE-2010-3930

Directory traversal vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to read arbitrary files via unspecified vectors related to AjaxSearch, a different vulnerability than CVE-2010-1427...

CVE-2010-3929

SQL injection vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to AjaxSearch...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 installer or 2 image editor...

Sql injection

SQL injection vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to AjaxSearch...

Directory traversal

Directory traversal vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to read arbitrary files via unspecified vectors related to AjaxSearch, a different vulnerability than CVE-2010-1427...

CVE-2011-0741

Multiple cross-site scripting XSS vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 installer or 2 image editor...

CVE-2010-3929

SQL injection vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to AjaxSearch...

CVE-2010-3930

Directory traversal vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to read arbitrary files via unspecified vectors related to AjaxSearch, a different vulnerability than CVE-2010-1427...

CVE-2010-3929

CVE-2010-3929 affects MODx Evolution up to version 1.0.4. The connected sources confirm a SQL injection vulnerability in AjaxSearch that allows a remote attacker to cause arbitrary SQL commands, leading to potential arbitrary PHP code execution per JVN entries. Impact is described as remote code ...

CVE-2010-3930

The CVE-2010-3930 issue affects MODx Evolution 1.0.4 and earlier, described as a directory traversal vulnerability related to AjaxSearch. Connected sources confirm a vulnerable component: the ucfg parameter handling in assets/snippets/ajaxSearch/ajaxSearchPopup.php allows a remote attacker to rea...

CVE-2011-0741

CVE-2011-0741: ModX Evolution versions prior to 1.0.5 are affected by multiple cross-site scripting (XSS) vulnerabilities exploitable via the installer or image editor. Remote attackers can inject arbitrary web script or HTML. The CVE entry describes the issue and impact as XSS with partial integ...

PT-2011-1454

Name of the Vulnerable Software and Affected Versions MODx Evolution versions 1.0.4 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is related to AjaxSearch, although the specific vectors are unknown. Recommendations For MODx Evolution versions...