MO
Vendor
Modx
44
CVEs
0
On KEV
0
New 30D
Products
MR9.8
Modx Revolution
Modx
36 CVEs0 on KEV0 new
EC5.4
Evolution Cms
Modx
3 CVEs0 on KEV0 new
RE8.8
Revolution
Modx
3 CVEs0 on KEV0 new
FR9.8
Fred
Modx
1 CVEs0 on KEV0 new
MO5.4
Modx
Modx
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-28010 | MO Modx Modx | 5.4 | Mar 13 | A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0 |
| CVE-2022-26149 | RE Revolution Modx | 7.2 | Feb 26 | MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting… |
| CVE-2020-25911 | MR Modx Revolution Modx | 9.1 | Oct 31 | A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service… |
| CVE-2019-14518 | EC Evolution Cms Modx | 5.4 | Aug 15 | Evolution CMS 2.0.x allows XSS via a description and new category location in a template |
| CVE-2019-1010178 | FR Fred Modx | 9.8 | Jul 24 | Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648 |
| CVE-2019-1010123 | MR Modx Revolution Modx | 7.5 | Jul 23 | MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type |
| CVE-2018-20755 | MR Modx Revolution Modx | 6.1 | Feb 6 | MODX Revolution through v2.7.0-pl allows XSS via the User Photo field |
| CVE-2018-20758 | MR Modx Revolution Modx | 5.4 | Feb 6 | MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description |
| CVE-2018-20757 | MR Modx Revolution Modx | 6.1 | Feb 6 | MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name |
| CVE-2018-20756 | MR Modx Revolution Modx | 6.1 | Feb 6 | MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of… |
| CVE-2018-16638 | EC Evolution Cms Modx | 5.4 | Dec 28 | Evolution CMS 1.4.x allows XSS via the manager/ search parameter |
| CVE-2018-16637 | EC Evolution Cms Modx | 5.4 | Dec 28 | Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI |
| CVE-2018-17556 | MR Modx Revolution Modx | 5.4 | Sep 26 | MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action |
| CVE-2018-1000208 | MR Modx Revolution Modx | 7.5 | Jul 13 | MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files |
| CVE-2018-1000207 | MR Modx Revolution Modx | 7.2 | Jul 13 | MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating… |
| CVE-2018-10382 | MR Modx Revolution Modx | 5.4 | Jun 1 | MODX Revolution 2.6.3 has XSS |
| CVE-2017-1000223 | MR Modx Revolution Modx | 5.4 | Nov 17 | A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier |
| CVE-2015-6588 | MR Modx Revolution Modx | 6.1 | Aug 29 | Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING |
| CVE-2017-11744 | MR Modx Revolution Modx | 6.1 | Jul 30 | In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS |
| CVE-2017-1000067 | RE Revolution Modx | 8.8 | Jul 17 | MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database… |
| CVE-2017-9071 | MR Modx Revolution Modx | 4.7 | May 18 | In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request |
| CVE-2017-9070 | MR Modx Revolution Modx | 5.4 | May 18 | In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php |
| CVE-2017-9069 | MR Modx Revolution Modx | 8.8 | May 18 | In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess |
| CVE-2017-9068 | MR Modx Revolution Modx | 6.1 | May 18 | In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type… |
| CVE-2017-9067 | MR Modx Revolution Modx | 7.0 | May 18 | In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action… |
| CVE-2017-8115 | MR Modx Revolution Modx | 5.3 | Apr 25 | Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system… |
| CVE-2017-7324 | MR Modx Revolution Modx | 9.8 | Mar 30 | setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter |
| CVE-2017-7323 | MR Modx Revolution Modx | 8.1 | Mar 30 | The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof… |
| CVE-2017-7322 | MR Modx Revolution Modx | 8.1 | Mar 30 | The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle… |
| CVE-2017-7321 | MR Modx Revolution Modx | 9.8 | Mar 30 | setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the… |
| CVE-2017-7320 | MR Modx Revolution Modx | 6.1 | Mar 30 | setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing… |
| CVE-2016-10039 | MR Modx Revolution Modx | 7.3 | Dec 24 | Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir… |
| CVE-2016-10038 | MR Modx Revolution Modx | 7.3 | Dec 24 | Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir… |
| CVE-2016-10037 | MR Modx Revolution Modx | 7.3 | Dec 24 | Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id… |
| CVE-2014-8992 | MR Modx Revolution Modx | – | Dec 22 | Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or… |
| CVE-2014-8775 | MR Modx Revolution Modx | – | Dec 3 | MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain… |
| CVE-2014-8774 | MR Modx Revolution Modx | – | Dec 3 | Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the… |
| CVE-2014-8773 | MR Modx Revolution Modx | – | Dec 3 | MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long… |
| CVE-2014-5451 | MR Modx Revolution Modx | – | Nov 6 | Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or… |
| CVE-2014-2736 | MR Modx Revolution Modx | – | Apr 24 | Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or… |
| CVE-2014-2311 | MR Modx Revolution Modx | – | Mar 11 | SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors |
| CVE-2014-2080 | MR Modx Revolution Modx | – | Mar 1 | Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML… |
| CVE-2010-5278 | MR Modx Revolution Modx | – | Oct 7 | Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows… |
| CVE-2010-4883 | RE Revolution Modx | – | Oct 7 | Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter |