Vulnerabilites related to modx - revolution
Vulnerability from fkie_nvd
Published
2017-07-17 13:18
Modified
2025-04-20 01:37
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.
References
cve@mitre.orghttps://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txtRelease Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txtRelease Notes, Third Party Advisory
Impacted products
Vendor Product Version
modx revolution 2.0.0
modx revolution 2.0.0
modx revolution 2.0.0
modx revolution 2.0.0
modx revolution 2.0.1
modx revolution 2.1.0
modx revolution 2.1.0
modx revolution 2.1.1
modx revolution 2.1.1
modx revolution 2.1.2
modx revolution 2.1.3
modx revolution 2.1.4
modx revolution 2.1.5
modx revolution 2.2.0
modx revolution 2.2.0
modx revolution 2.2.0
modx revolution 2.2.0
modx revolution 2.2.1
modx revolution 2.2.2
modx revolution 2.2.3
modx revolution 2.2.4
modx revolution 2.2.5
modx revolution 2.2.6
modx revolution 2.2.7
modx revolution 2.2.8
modx revolution 2.2.9
modx revolution 2.3.0
modx revolution 2.3.1
modx revolution 2.4.0
modx revolution 2.4.1
modx revolution 2.5.0
modx revolution 2.5.1
modx revolution 2.5.2
modx revolution 2.5.3
modx revolution 2.5.4
modx revolution 2.5.5
modx revolution 2.5.6


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCC01BEC-3376-4C94-9DCA-2C82DE75E810",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.0.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "E13093C8-6D9D-4542-A6AF-2C9FFA59BC0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "5D7F5C6A-33DC-41F2-ACDD-B7358024F9DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.0.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "5DC561AA-5730-4D15-88BC-2BAA99FEDD45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F00392B-6B2E-455C-AD3C-97D2C8692300",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB19DC1E-477B-4CB2-88AE-7B693701AB75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.1.0:p12:*:*:*:*:*:*",
              "matchCriteriaId": "1DD8E758-588B-4706-B4DA-097009C9829E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6079B90E-A472-4286-920F-312C003F3BE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.1.1:p12:*:*:*:*:*:*",
              "matchCriteriaId": "CA68C845-CCE6-4036-8DA5-E451F0912943",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB4D2D85-9A84-456B-9970-0DFB43360F60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC0C400F-97FC-4BDA-B583-8E587BD44C7E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "21BC9C96-2F59-4C70-844A-C96BF85ED4B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C085106-26AF-4F3B-A649-84D60687B25D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BFDDBE7-77A0-4552-AA01-4D7DD502D731",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "DA997F7B-23CB-4215-9FDB-441E75C1565E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "FDFFDFC0-268C-435D-9A6D-CF96D33F5302",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "EC36839A-2A85-450C-A7E6-C0D5374832EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "87591447-499C-4C97-8436-845F2A9006EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA1153BA-7050-40E1-90C9-75071114F153",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "997C5948-45E2-4BB6-B12C-EDA839015EEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "50905CD0-B72A-4AB6-ADA9-1C7353D14917",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBB51ED9-9683-42A8-ABB6-CC21521DA808",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "745972A9-B150-4462-872A-3085E35D929C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "D09F11AE-7719-48ED-BC11-03A7F5DA3A08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8CCC7E4-D602-473D-A944-6869747052E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.2.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0B57252-10D4-4D0B-B70D-3D138B2D4249",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "ACC26BED-7BF3-4D3D-BCFA-497C8DCAF658",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "32772FEB-430E-4F96-8B5F-6C786BE3D7BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "79DB2AA8-3569-42BA-94D6-CEA59916A3A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0501306-7E8F-4AB1-9179-247B0C4B7806",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFD0D4D8-FC21-40B8-A5D3-454B864FA0FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "744C0B94-7F15-4C35-9A1C-81A65F45D35C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "382F6AFC-7338-4133-B233-DE1D093340F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F328ADB0-F1C0-46F5-9F87-8EB72B285330",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "54C40375-1110-4EEB-8120-74D1D23C137F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEB7E380-740A-4B2A-8186-CDD2835D65D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE616B3E-1B31-4191-A041-CE4E900A3F86",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges."
    },
    {
      "lang": "es",
      "value": "MODX Revolution versi\u00f3n 2.x hasta 2.5.6, es vulnerable a inyecci\u00f3n SQL ciega causada por un saneamiento inapropiado mediante el m\u00e9todo de escape, resultando en que un usuario autenticado acceda a la base de datos y posiblemente escale privilegios."
    }
  ],
  "id": "CVE-2017-1000067",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-07-17T13:18:18.127",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "url": "https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2011-10-07 10:55
Modified
2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter.
References
cve@mitre.orghttp://modxcms.com/forums/index.php/topic%2C55104.0.html
cve@mitre.orghttp://modxcms.com/forums/index.php/topic%2C55105.0.html
cve@mitre.orghttp://packetstormsecurity.org/1009-exploits/modx202pl-xss.txtExploit
cve@mitre.orghttp://secunia.com/advisories/41638Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/8435
cve@mitre.orghttp://www.osvdb.org/68264Exploit
cve@mitre.orghttp://www.securityfocus.com/bid/43577Exploit
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/62070
af854a3a-2127-422b-91ae-364da2661108http://modxcms.com/forums/index.php/topic%2C55104.0.html
af854a3a-2127-422b-91ae-364da2661108http://modxcms.com/forums/index.php/topic%2C55105.0.html
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.org/1009-exploits/modx202pl-xss.txtExploit
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/41638Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8435
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/68264Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/43577Exploit
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/62070
Impacted products
Vendor Product Version
modx revolution 2.0.2-pl


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:modx:revolution:2.0.2-pl:*:*:*:*:*:*:*",
              "matchCriteriaId": "A69DA2ED-345D-4169-9081-BB09EF1B95CA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter."
    },
    {
      "lang": "es",
      "value": "vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en manager/index.php en MODx Revolution v2.0.2-pl, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro modhash."
    }
  ],
  "id": "CVE-2010-4883",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.6,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2011-10-07T10:55:08.770",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://modxcms.com/forums/index.php/topic%2C55104.0.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://modxcms.com/forums/index.php/topic%2C55105.0.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.org/1009-exploits/modx202pl-xss.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/41638"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/8435"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.osvdb.org/68264"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/43577"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62070"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://modxcms.com/forums/index.php/topic%2C55104.0.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://modxcms.com/forums/index.php/topic%2C55105.0.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.org/1009-exploits/modx202pl-xss.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/41638"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/8435"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.osvdb.org/68264"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.securityfocus.com/bid/43577"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62070"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-02-26 21:15
Modified
2024-11-21 06:53
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
References
cve@mitre.orghttp://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html
cve@mitre.orghttps://github.com/sartlabs/0days/blob/main/Modx/Exploit.txtExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html
af854a3a-2127-422b-91ae-364da2661108https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txtExploit, Third Party Advisory
Impacted products
Vendor Product Version
modx revolution *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:modx:revolution:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "229ACF55-FAE2-4B70-A489-81F6E5AC6D4A",
              "versionEndIncluding": "2.8.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator."
    },
    {
      "lang": "es",
      "value": "MODX Revolution versiones hasta 2.8.3-pl, permite a administradores remotos autenticados ejecutar c\u00f3digo arbitrario al subir un archivo ejecutable, ya que la configuraci\u00f3n de Tipos de Archivos para Subir puede ser cambiada por un administrador.\n"
    }
  ],
  "id": "CVE-2022-26149",
  "lastModified": "2024-11-21T06:53:31.743",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-02-26T21:15:08.013",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2010-4883 (GCVE-0-2010-4883)
Vulnerability from cvelistv5
Published
2011-10-07 10:00
Modified
2024-08-07 04:02
Severity ?
CWE
  • n/a
Summary
Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter.
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/62070vdb-entry, x_refsource_XF
http://www.osvdb.org/68264vdb-entry, x_refsource_OSVDB
http://modxcms.com/forums/index.php/topic%2C55105.0.htmlx_refsource_CONFIRM
http://modxcms.com/forums/index.php/topic%2C55104.0.htmlx_refsource_CONFIRM
http://www.securityfocus.com/bid/43577vdb-entry, x_refsource_BID
http://secunia.com/advisories/41638third-party-advisory, x_refsource_SECUNIA
http://packetstormsecurity.org/1009-exploits/modx202pl-xss.txtx_refsource_MISC
http://securityreason.com/securityalert/8435third-party-advisory, x_refsource_SREASON
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:02:29.848Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "modx-modahsh-xss(62070)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62070"
          },
          {
            "name": "68264",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/68264"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://modxcms.com/forums/index.php/topic%2C55105.0.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://modxcms.com/forums/index.php/topic%2C55104.0.html"
          },
          {
            "name": "43577",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/43577"
          },
          {
            "name": "41638",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/41638"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.org/1009-exploits/modx202pl-xss.txt"
          },
          {
            "name": "8435",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/8435"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-09-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "modx-modahsh-xss(62070)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62070"
        },
        {
          "name": "68264",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/68264"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://modxcms.com/forums/index.php/topic%2C55105.0.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://modxcms.com/forums/index.php/topic%2C55104.0.html"
        },
        {
          "name": "43577",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/43577"
        },
        {
          "name": "41638",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/41638"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.org/1009-exploits/modx202pl-xss.txt"
        },
        {
          "name": "8435",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/8435"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-4883",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "modx-modahsh-xss(62070)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62070"
            },
            {
              "name": "68264",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/68264"
            },
            {
              "name": "http://modxcms.com/forums/index.php/topic,55105.0.html",
              "refsource": "CONFIRM",
              "url": "http://modxcms.com/forums/index.php/topic,55105.0.html"
            },
            {
              "name": "http://modxcms.com/forums/index.php/topic,55104.0.html",
              "refsource": "CONFIRM",
              "url": "http://modxcms.com/forums/index.php/topic,55104.0.html"
            },
            {
              "name": "43577",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/43577"
            },
            {
              "name": "41638",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/41638"
            },
            {
              "name": "http://packetstormsecurity.org/1009-exploits/modx202pl-xss.txt",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.org/1009-exploits/modx202pl-xss.txt"
            },
            {
              "name": "8435",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/8435"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-4883",
    "datePublished": "2011-10-07T10:00:00",
    "dateReserved": "2011-10-07T00:00:00",
    "dateUpdated": "2024-08-07T04:02:29.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-26149 (GCVE-0-2022-26149)
Vulnerability from cvelistv5
Published
2022-02-26 00:00
Modified
2024-08-03 04:56
Severity ?
CWE
  • n/a
Summary
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
References
https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt
http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:56:37.844Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-27T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt"
        },
        {
          "url": "http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-26149",
    "datePublished": "2022-02-26T00:00:00",
    "dateReserved": "2022-02-26T00:00:00",
    "dateUpdated": "2024-08-03T04:56:37.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-1000067 (GCVE-0-2017-1000067)
Vulnerability from cvelistv5
Published
2017-07-13 20:00
Modified
2024-08-05 21:53
Severity ?
CWE
  • n/a
Summary
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.
References
https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txtx_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T21:53:06.137Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2017-05-06T00:00:00",
      "datePublic": "2017-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-13T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2017-05-06T20:43:28.318287",
          "ID": "CVE-2017-1000067",
          "REQUESTER": "antirais@gmail.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt",
              "refsource": "CONFIRM",
              "url": "https://github.com/modxcms/revolution/blob/9bf1c6cf7bdc12190b404f93ce7798b39c07bc59/core/xpdo/changelog.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-1000067",
    "datePublished": "2017-07-13T20:00:00",
    "dateReserved": "2017-07-10T00:00:00",
    "dateUpdated": "2024-08-05T21:53:06.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}