Modx vulnerabilities

Products

• Revolution 36
• Evolution Cms 3
• Revolution 3

Newest

• modx MODX allows cross-site scripting (XSS) via an SVG file CVE-2025-28010 5.4 MediumMarch 13, 2025
• modx revolution Unrestricted Upload of File with Dangerous Type in MODX Revolution CVE-2022-26149 Public exploit 7.2 HighFebruary 26, 2022
• modx revolution XML External Entity vulnerability in MODX CMS CVE-2020-25911 Fix available 9.1 CriticalOctober 31, 2021
• modx evolution cms ** DISPUTED ** Evolution CMS 2.0.x allows XSS via a description and new category location in a... CVE-2019-14518 Disputed 5.4 MediumAugust 15, 2019
• fred modx revolution, modx fred +1 more Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact... CVE-2019-1010178 9.8 CriticalJuly 24, 2019
• modx revolution, modx revolution gallery +1 more MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous... CVE-2019-1010123 7.5 HighJuly 23, 2019
• modx revolution MODX vulnerability allows for XSS via user settings parameters CVE-2018-20758 Fix available 5.4 MediumFebruary 6, 2019
• modx revolution MODX Revolution allows XSS through extended user fields CVE-2018-20757 Fix available 6.1 MediumFebruary 6, 2019
• modx revolution MODX Revolution allows XSS via document resources CVE-2018-20756 Fix available 6.1 MediumFebruary 6, 2019
• modx revolution MODX Revolution vulnerable to XSS attack through its User Photo field CVE-2018-20755 Fix available 6.1 MediumFebruary 6, 2019
• modx evolution cms Evolution CMS Cross-site Scripting (XSS) CVE-2018-16638 Fix available 5.4 MediumDecember 28, 2018
• modx evolution cms Evolution CMS Stored Cross-site Scripting (XSS) CVE-2018-16637 Fix available 5.4 MediumDecember 28, 2018
• modx revolution MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action. CVE-2018-17556 5.4 MediumSeptember 26, 2018
• modx revolution MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx... CVE-2018-1000208 7.5 HighJuly 13, 2018
• modx revolution MODX Revolution Incorrect Access Control vulnerability CVE-2018-1000207 Fix available EPSS 64.1% 7.2 HighJuly 13, 2018
• modx revolution MODX Revolution 2.6.3 has XSS. CVE-2018-10382 5.4 MediumJune 1, 2018
• modx revolution A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS... CVE-2017-1000223 5.4 MediumNovember 17, 2017
• modx revolution Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows... CVE-2015-6588 6.1 MediumAugust 29, 2017
• modx revolution In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are... CVE-2017-11744 6.1 MediumJuly 30, 2017
• modx revolution MODX Revolution blind SQL injection CVE-2017-1000067 Fix available 8.8 HighJuly 13, 2017
• modx revolution MODX Revolution XSS via HTTP Host header CVE-2017-9071 Fix available 4.7 MediumMay 18, 2017
• modx revolution MODX Revolution cross-site scripting vulnerability CVE-2017-9070 Fix available 5.4 MediumMay 18, 2017
• modx revolution MODX Revolution allows overwriting .htaccess CVE-2017-9069 Fix available 8.8 HighMay 18, 2017
• modx revolution MODX Revolution Reflected XSS CVE-2017-9068 Fix available 6.1 MediumMay 18, 2017
• modx revolution, php +1 more MODX Revolution Directory Traversal Vulnerability CVE-2017-9067 Fix available 7.0 HighMay 18, 2017
• modx revolution Directory traversal in setup/processors/url_search.php (aka the search page of an unused... CVE-2017-8115 5.3 MediumApril 25, 2017
• modx revolution setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to... CVE-2017-7324 9.8 CriticalMarch 30, 2017
• modx revolution The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use... CVE-2017-7323 8.1 HighMarch 30, 2017
• modx revolution The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do... CVE-2017-7322 8.1 HighMarch 30, 2017
• modx revolution setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to... CVE-2017-7321 9.8 CriticalMarch 30, 2017
• modx revolution setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly... CVE-2017-7320 6.1 MediumMarch 30, 2017
• modx revolution Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote... CVE-2016-10039 7.3 HighDecember 24, 2016
• modx revolution Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote... CVE-2016-10038 7.3 HighDecember 24, 2016
• modx revolution Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote... CVE-2016-10037 7.3 HighDecember 24, 2016
• modx revolution Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in... CVE-2014-8992 4.3 MediumDecember 22, 2014
• modx revolution MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for... CVE-2014-8775 Public exploit 5.0 MediumDecember 3, 2014
• modx revolution Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2... CVE-2014-8774 Public exploit 4.3 MediumDecember 3, 2014
• modx revolution MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request... CVE-2014-8773 Public exploit 6.8 MediumDecember 3, 2014
• modx revolution Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX... CVE-2014-5451 4.3 MediumNovember 6, 2014
• modx revolution Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to... CVE-2014-2736 7.5 HighApril 24, 2014
• modx revolution SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows... CVE-2014-2311 7.5 HighMarch 11, 2014
• modx revolution Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX... CVE-2014-2080 4.3 MediumFebruary 28, 2014
• modx revolution Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx... CVE-2010-5278 Public exploit EPSS 18.6% 4.3 MediumOctober 7, 2012
• modx revolution Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows... CVE-2010-4883 Public exploit 2.6 LowOctober 7, 2011