Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

modx/revolution

14 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 1 medium
Registry
Packagist

Advisories 14

  • CVE-2025-28010Medium 5.4

    A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0.

    Affected: through 3.1.0.

  • MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file…

    Affected: through 2.8.3-pl.

  • A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an…

    Affected: fixed in 2.8.0.

  • MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.

    Affected: fixed in 2.7.1-pl.

  • MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.

    Affected: fixed in 2.7.1-pl.

  • MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a…

    Affected: fixed in 2.7.1-pl.

  • MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.

    Affected: fixed in 2.7.1-pl.

  • MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into…

    Affected: fixed in 2.7.0.

  • MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in…

    Affected: from 2.0.0, fixed in 2.6.0.

  • In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request.

    Affected: fixed in 2.5.7.

  • In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the…

    Affected: fixed in 2.5.7.

  • In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name…

    Affected: fixed in 2.5.7.

  • In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page…

    Affected: fixed in 2.5.7.

  • In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due…

    Affected: fixed in 2.5.7.