# modx/revolution (Packagist) vulnerabilities 14 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/modx/revolution ## Advisories (14) ### [CVE-2025-28010](https://cve.now/CVE-2025-28010): A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. - Severity: Medium 5.4 - Published: Mar 13, 2025 - Affected: through 3.1.0. ### [CVE-2022-26149](https://cve.now/CVE-2022-26149): MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file… - Severity: Unrated - Published: Feb 26, 2022 - Affected: through 2.8.3-pl. ### [CVE-2020-25911](https://cve.now/CVE-2020-25911): A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an… - Severity: Unrated - Published: Oct 31, 2021 - Affected: fixed in 2.8.0. ### [CVE-2018-20758](https://cve.now/CVE-2018-20758): MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description. - Severity: Unrated - Published: Feb 6, 2019 - Affected: fixed in 2.7.1-pl. ### [CVE-2018-20757](https://cve.now/CVE-2018-20757): MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name. - Severity: Unrated - Published: Feb 6, 2019 - Affected: fixed in 2.7.1-pl. ### [CVE-2018-20756](https://cve.now/CVE-2018-20756): MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a… - Severity: Unrated - Published: Feb 6, 2019 - Affected: fixed in 2.7.1-pl. ### [CVE-2018-20755](https://cve.now/CVE-2018-20755): MODX Revolution through v2.7.0-pl allows XSS via the User Photo field. - Severity: Unrated - Published: Feb 6, 2019 - Affected: fixed in 2.7.1-pl. ### [CVE-2018-1000207](https://cve.now/CVE-2018-1000207): MODX Revolution version \<=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into… - Severity: Unrated - Published: Jul 13, 2018 - Affected: fixed in 2.7.0. ### [CVE-2017-1000067](https://cve.now/CVE-2017-1000067): MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in… - Severity: Unrated - Published: Jul 13, 2017 - Affected: from 2.0.0, fixed in 2.6.0. ### [CVE-2017-9071](https://cve.now/CVE-2017-9071): In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. - Severity: Unrated - Published: May 18, 2017 - Affected: fixed in 2.5.7. ### [CVE-2017-9070](https://cve.now/CVE-2017-9070): In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the… - Severity: Unrated - Published: May 18, 2017 - Affected: fixed in 2.5.7. ### [CVE-2017-9069](https://cve.now/CVE-2017-9069): In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name… - Severity: Unrated - Published: May 18, 2017 - Affected: fixed in 2.5.7. ### [CVE-2017-9068](https://cve.now/CVE-2017-9068): In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page… - Severity: Unrated - Published: May 18, 2017 - Affected: fixed in 2.5.7. ### [CVE-2017-9067](https://cve.now/CVE-2017-9067): In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due… - Severity: Unrated - Published: May 18, 2017 - Affected: fixed in 2.5.7. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/modx/revolution Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.