PT-2014-4893

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.2.14 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the session ID PHPSESSID to index.php. Additionally, remote authenticated users can execute...

PT-2011-1818

Name of the Vulnerable Software and Affected Versions MODx Revolution version 2.0.2-pl Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the modhash parameter in the "manager/index.php" endpoint. Recommendations For MODx Revolution...

CVE-2010-4883: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter...

CVE-2009-3418: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow 1 remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an editlink action to...

CVE-2008-7242: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the 1 search, 2 "a," 3 messagesubject, and 4 messagebody parameters to certain pages as reachable from manager/index.php; 5 highlight, 6 id, 7 email...

CVE-2008-7243: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether this is related to...

CVE-2006-6047: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then...

CVE-2006-3904: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magicquotesgpc disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...