CVE-2010-3930

Directory traversal vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to read arbitrary files via unspecified vectors related to AjaxSearch, a different vulnerability than CVE-2010-1427...

Sql injection

SQL injection vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to AjaxSearch...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 installer or 2 image editor...

Directory traversal

Directory traversal vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to read arbitrary files via unspecified vectors related to AjaxSearch, a different vulnerability than CVE-2010-1427...

CVE-2010-3930

Directory traversal vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to read arbitrary files via unspecified vectors related to AjaxSearch, a different vulnerability than CVE-2010-1427...

CVE-2011-0741

Multiple cross-site scripting XSS vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the 1 installer or 2 image editor...

CVE-2011-0741

CVE-2011-0741: ModX Evolution versions prior to 1.0.5 are affected by multiple cross-site scripting (XSS) vulnerabilities exploitable via the installer or image editor. Remote attackers can inject arbitrary web script or HTML. The CVE entry describes the issue and impact as XSS with partial integ...

CVE-2010-3929

CVE-2010-3929 affects MODx Evolution up to version 1.0.4. The connected sources confirm a SQL injection vulnerability in AjaxSearch that allows a remote attacker to cause arbitrary SQL commands, leading to potential arbitrary PHP code execution per JVN entries. Impact is described as remote code ...

CVE-2010-3929

SQL injection vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to AjaxSearch...

CVE-2010-3930

The CVE-2010-3930 issue affects MODx Evolution 1.0.4 and earlier, described as a directory traversal vulnerability related to AjaxSearch. Connected sources confirm a vulnerable component: the ucfg parameter handling in assets/snippets/ajaxSearch/ajaxSearchPopup.php allows a remote attacker to rea...

MODx Evo 1.0.4 (and prior) SQL Injection and Directory Traversal Vulnerabities

Status: Solved Product: MODx Evolution Severity: High Versions: 1.0.4 and prior Advisory Date: 2011-01-26 Fixed Date: 2011-01-19 Impact: a A remote attacker may access or view arbitrary files on the server. b A remote attacker may execute arbitrary PHP code as a result of SQL injection. Descripti...

MODx Evolution vulnerable to directory traversal

Overview MODx Evolution contains a directory traversal vulnerability. MODx provided by the MODx CMS Project is a Content Management System CMS software. MODx contains a directory traversal vulnerability. Impact A remote attacker may access or view arbitrary files on the server. Solution Update th...

MODx Evolution vulnerable to SQL injection

Overview MODx Evolution contains a SQL injection vulnerability. MODx provided by the MODx CMS Project is a Content Management System CMS software. MODx Evolution contains SQL injection vulnerability. Impact A remote attacker may execute arbitrary PHP code as a result of SQL injection. Solution...

JVN#95385972: MODx Evolution vulnerable to directory traversal

MODx provided by the MODx CMS Project is a Content Management System CMS software. MODx contains a directory traversal vulnerability. Impact A remote attacker may access or view arbitrary files on the server. Solution Update the software Update to the latest version according to the information...

JVN#54092716: MODx Evolution vulnerable to SQL injection

MODx provided by the MODx CMS Project is a Content Management System CMS software. MODx Evolution contains SQL injection vulnerability. Impact A remote attacker may execute arbitrary PHP code as a result of SQL injection. Solution Update the software Update to the latest version according to the...

Critical PHP Bug Security Notice and Patch

Earlier this week, a PHP Security Notice was made due to a critical bug in PHP that could cause PHP to fail should a value of 2.2250738585072011e-308 be set to a PHP value. More information can be found here: http://bugs.php.net/bug.php?id=53632...

Critical Security Upgrade Notice for FormIt, Quip and Login

We received a report of a potential vulnerability in FormIt, Quip and Login that could be used to expose system settings including database information. This has been been corrected and new versions have been posted. Upgrading of FormIt, Login and Quip to the latest versions via Package Manager...

MODx login.php 'username' Parameter XSS

The installed version of MODx fails to adequately sanitize input passed to the 'username' parameter in the 'login.php' script before using it to generate dynamic HTML content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into a...

MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability

Exploit for php platform in category web applications ===================================================================== MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability ===================================================================== getObject'modUser',array 30: 'use...

MODx REvolution CMS 2.0.4-pl2 - POST injection Cross-Site Scripting

MODx REvolution CMS 2.0.4-pl2 - POST injection Cross-Site Scripting getObject'modUser',array 30: 'username' = $POST'username', 31: ; ... 71: else if !empty$POST'forgotlogin' 72: $c = $modx-newQuery'modUser'; 73: $c-selectarray'modUser.','Profile.email','Profile.fullname'; 74: $...