MR
Product
Modx Revolution
36
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 10Medium 14Low 0
Watch
Add Modx Revolution to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-20757 | 6.1 | Feb 6 | MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name Affected: through 2.7.0; 2.7.0 |
| CVE-2018-20756 | 6.1 | Feb 6 | MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of… Affected: through 2.7.0; 2.7.0 |
| CVE-2018-20755 | 6.1 | Feb 6 | MODX Revolution through v2.7.0-pl allows XSS via the User Photo field Affected: through 2.7.0; 2.7.0 |
| CVE-2015-6588 | 6.1 | Aug 29 | Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING Affected: through 1.9.0 |
| CVE-2017-11744 | 6.1 | Jul 30 | In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS Affected: 2.5.7 |
| CVE-2017-9068 | 6.1 | May 18 | In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type… Affected: through 2.5.6 |
| CVE-2017-7320 | 6.1 | Mar 30 | setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing… Affected: through 2.5.4 |
| CVE-2018-20758 | 5.4 | Feb 6 | MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description Affected: through 2.7.0 |
| CVE-2018-17556 | 5.4 | Sep 26 | MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action Affected: 2.6.5 |
| CVE-2018-10382 | 5.4 | Jun 1 | MODX Revolution 2.6.3 has XSS Affected: 2.6.3 |
| CVE-2017-1000223 | 5.4 | Nov 17 | A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier Affected: through 2.5.6 |
| CVE-2017-9070 | 5.4 | May 18 | In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php Affected: through 2.5.6 |
| CVE-2017-8115 | 5.3 | Apr 25 | Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system… Affected: 2.5.7 |
| CVE-2017-9071 | 4.7 | May 18 | In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request Affected: through 2.5.6 |
Showing 14