CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-25911
https://notcve.org/view.php?id=CVE-2020-25911
A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS). Se detectó una vulnerabilidad de entidad externa XML (XXE) en el componente modRestServiceRequest en MODX CMS versión 2.7.3, que puede conllevar a una divulgación de información o denegación de servicio (DOS) • https://github.com/dahua966/Vul_disclose/blob/main/XXE_modxcms.md https://github.com/modxcms/revolution/issues/15237 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-1010123
https://notcve.org/view.php?id=CVE-2019-1010123
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via /assets/components/gallery/connector.php. MODX Revolution Gallery versión 1.7.0, está afectado por: CWE-434: Carga sin Restricciones de Archivos con Tipos Peligrosos. • https://modx.pro/security/15912#comment-99640 https://modx.today/posts/2018/07/critical-security-vulnerability-in-gallery-1.7.1 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2018-20757
https://notcve.org/view.php?id=CVE-2018-20757
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name. MODX Revolution, hasta la versión v2.7.0-pl, permite Cross-Site Scripting (XSS) mediante un campo de usuario extendido, como los nombres de Container o Attribute. • https://github.com/modxcms/revolution/issues/14104 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2018-20755
https://notcve.org/view.php?id=CVE-2018-20755
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field. MODX Revolution, hasta la versión v2.7.0-pl, permite Cross-Site Scripting (XSS) mediante el campo User Photo. • https://github.com/modxcms/revolution/issues/14102 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20758
https://notcve.org/view.php?id=CVE-2018-20758
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description. MODX Revolution, hasta la versión v2.7.0-pl, permite Cross-Site Scripting (XSS) mediante las opciones de usuario como "Description". • https://github.com/modxcms/revolution/issues/14103 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •