Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40 results
Feb 26, 2022MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable FiCVE-2022-26149 · Other software · Modx · reported by MITREHigh 7.2
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
- Product
- Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Oct 31, 2021A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure orCVE-2020-25911 · Other software · Modx · reported by MITRECritical 9.1
A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2019Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648.CVE-2019-1010178 · Other software · Fred · reported by josh@bress.netCritical 9.8
Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is: https://github.com/modxcms/fred/commit/139cefac83b2ead90da23187d92739dec79d3ccd and https://github.com/modxcms/fred/commit/01f0a3d1ae7f3970639c2a0db1887beba0065246.
- Product
- MODX Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyoutube.comyoutube.com
Jul 23, 2019MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type.CVE-2019-1010123 · Other software · MODX Revolution · reported by josh@bress.netHigh 7.5
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via /assets/components/gallery/connector.php.
- Product
- Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.CVE-2018-20758 · Other software · Modx · reported by MITREMedium 5.4
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.CVE-2018-20757 · Other software · Modx · reported by MITREMedium 6.1
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or tCVE-2018-20756 · Other software · Modx · reported by MITREMedium 6.1
MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.CVE-2018-20755 · Other software · Modx · reported by MITREMedium 6.1
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2018MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.CVE-2018-17556 · Other software · Modx · reported by MITREMedium 5.4
MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2018MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files.CVE-2018-1000208 · Other software · Modx · reported by MITREHigh 7.5
MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files. This attack appear to be exploitable via web request via security/login processor. This vulnerability appears to have been fixed in pull 13980.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2018MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can CVE-2018-1000207 · Other software · Modx · reported by MITREHigh 7.2
MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2018MODX Revolution 2.6.3 has XSS.CVE-2018-10382 · Other software · Modx · reported by MITREMedium 5.4
MODX Revolution 2.6.3 has XSS.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2017A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier.CVE-2017-1000223 · Other software · Modx · reported by MITREMedium 5.4
A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comraw.githubusercontent.com
Aug 29, 2017Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via thCVE-2015-6588 · Other software · Modx · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Jul 30, 2017In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS.CVE-2017-11744 · Other software · Modx · reported by MITREMedium 6.1
In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2017MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user acCVE-2017-1000067 · Other software · Modx · reported by MITREHigh 8.8
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.
- Product
- Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2017In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request.CVE-2017-9071 · Other software · Modx · reported by MITREMedium 4.7
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcitadelo.comgithub.com
May 18, 2017In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to conneCVE-2017-9070 · Other software · Modx · reported by MITREMedium 5.4
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcitadelo.comgithub.com
May 18, 2017In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.CVE-2017-9069 · Other software · Modx · reported by MITREHigh 8.8
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcitadelo.comgithub.com
May 18, 2017In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by thCVE-2017-9068 · Other software · Modx · reported by MITREMedium 6.1
In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcitadelo.comgithub.com
May 18, 2017In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validaCVE-2017-9067 · Other software · Modx · reported by MITREHigh 7
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcitadelo.comgithub.com
Apr 25, 2017Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtCVE-2017-8115 · Other software · Modx · reported by MITREMedium 5.3
Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2017setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.CVE-2017-7324 · Other software · Modx · reported by MITRECritical 9.8
setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commazinahmed.net
Mar 30, 2017The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middleCVE-2017-7323 · Other software · Modx · reported by MITREHigh 8.1
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code by leveraging the lack of the HTTPS protection mechanism.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commazinahmed.net
Mar 30, 2017The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows manCVE-2017-7322 · Other software · Modx · reported by MITREHigh 8.1
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commazinahmed.net
Mar 30, 2017setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the CVE-2017-7321 · Other software · Modx · reported by MITRECritical 9.8
setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commazinahmed.net
Mar 30, 2017setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to condCVE-2017-7320 · Other software · Modx · reported by MITREMedium 6.1
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commazinahmed.net
Dec 24, 2016Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation vCVE-2016-10039 · Other software · Modx · reported by MITREHigh 7.3
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Dec 24, 2016Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation vCVE-2016-10038 · Other software · Modx · reported by MITREHigh 7.3
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Dec 24, 2016Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation vCVE-2016-10037 · Other software · Modx · reported by MITREHigh 7.3
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id (aka dir) parameter, related to browser/directory/getlist.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Dec 22, 2014Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitraCVE-2014-8992 · Other software · Modx · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2014MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers tCVE-2014-8775 · Other software · Modx · reported by MITREMedium 5
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.modx.comhacktivity.websecgeeks.com
Dec 3, 2014Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTMCVE-2014-8774 · Other software · Modx · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key parameter.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.modx.comhacktivity.websecgeeks.com
Dec 3, 2014MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token orCVE-2014-8773 · Other software · Modx · reported by MITREMedium 6.8
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.modx.comhacktivity.websecgeeks.com
Nov 6, 2014Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitCVE-2014-5451 · Other software · Modx · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Apr 24, 2014Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSCVE-2014-2736 · Other software · Modx · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comforums.modx.com
Mar 11, 2014SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vCVE-2014-2311 · Other software · Modx · reported by MITREHigh 7.5
SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.modx.commodx.com
Feb 28, 2014Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary weCVE-2014-2080 · Other software · Modx · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2012Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is diCVE-2010-5278 · Other software · Modx · reported by MITREMedium 4.3
Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. NOTE: some of these details are obtained from third party information.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmodxcms.commodxcms.com
Oct 7, 2011Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via theCVE-2010-4883 · Other software · Modx · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter.
- Product
- Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmodxcms.commodxcms.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.