CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2025-28010
https://notcve.org/view.php?id=CVE-2025-28010
13 Mar 2025 — A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image. • https://github.com/rtnthakur/CVE/blob/main/MODX/README.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 3%CPEs: 1EXPL: 3CVE-2022-26149 – MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2022-26149
26 Feb 2022 — MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator. MODX Revolution versiones hasta 2.8.3-pl, permite a administradores remotos autenticados ejecutar código arbitrario al subir un archivo ejecutable, ya que la configuración de Tipos de Archivos para Subir puede ser cambiada por un administrador. MODX Revolution version 2.8.3-pl suffers from an authe... • https://packetstorm.news/files/id/171488 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-25911
https://notcve.org/view.php?id=CVE-2020-25911
31 Oct 2021 — A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS). Se detectó una vulnerabilidad de entidad externa XML (XXE) en el componente modRestServiceRequest en MODX CMS versión 2.7.3, que puede conllevar a una divulgación de información o denegación de servicio (DOS) • https://github.com/dahua966/Vul_disclose/blob/main/XXE_modxcms.md • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 3CVE-2019-14518
https://notcve.org/view.php?id=CVE-2019-14518
15 Aug 2019 — Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel. ** EN DISPUTA ** Evolution CMS 2.0.x permite XSS a través de una descripción y una nueva ubicación de categoría en una plantilla. NOTA: el proveedor indica que el comportamiento es consistente con la "política de acceso en el panel de administración" • https://github.com/evolution-cms/evolution/issues/1041 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 7EXPL: 1CVE-2019-1010178
https://notcve.org/view.php?id=CVE-2019-1010178
24 Jul 2019 — Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is: https://github.com/modxcms/fred/commit/139cefac83b2ead90da23187d92739dec79d3ccd and https://github.com/modxcms/fred/commit/01f0a3d1ae7f3970639c2a0db1887beba0065246. • https://www.youtube.com/watch?v=vOlw2DP9WbE • CWE-269: Improper Privilege Management CWE-648: Incorrect Use of Privileged APIs •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-1010123
https://notcve.org/view.php?id=CVE-2019-1010123
23 Jul 2019 — MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via /assets/components/gallery/connector.php. MODX Revolution Gallery versión 1.7.0, está afectado por: CWE-434: Carga sin Restricciones de Archivos con Tipos Peligrosos. • https://modx.pro/security/15912#comment-99640 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2018-20755
https://notcve.org/view.php?id=CVE-2018-20755
06 Feb 2019 — MODX Revolution through v2.7.0-pl allows XSS via the User Photo field. MODX Revolution, hasta la versión v2.7.0-pl, permite Cross-Site Scripting (XSS) mediante el campo User Photo. • https://github.com/modxcms/revolution/issues/14102 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2018-20756
https://notcve.org/view.php?id=CVE-2018-20756
06 Feb 2019 — MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs. MODX Revolution, hasta la versión v2.7.0-pl, permite Cross-Site Scripting (XSS) mediante un recurso de documento (como un pagetitle), que se gestiona de manera incorrecta durante una acción Update, Quick Edit, o durante la visualización de los registros de administración. • https://github.com/modxcms/revolution/issues/14105 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2018-20757
https://notcve.org/view.php?id=CVE-2018-20757
06 Feb 2019 — MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name. MODX Revolution, hasta la versión v2.7.0-pl, permite Cross-Site Scripting (XSS) mediante un campo de usuario extendido, como los nombres de Container o Attribute. • https://github.com/modxcms/revolution/issues/14104 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20758
https://notcve.org/view.php?id=CVE-2018-20758
06 Feb 2019 — MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description. MODX Revolution, hasta la versión v2.7.0-pl, permite Cross-Site Scripting (XSS) mediante las opciones de usuario como "Description". • https://github.com/modxcms/revolution/issues/14103 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •