Known vulnerabilities in MODX Revolution

Vendor: MODX
Software CPE: cpe:2.3:a:modx:modx_revolution:*:*:*:*:*:*:*:*
Total vulnerabilities: 16
Public exploits: 4
Known exploited (KEV): 0
Highest CVSSv4 Score: 7.7

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting MODX Revolution MODX Revolution is affected by 16 known vulnerabilities: 5 medium, 11 low Critical High Medium Low

Vulnerabilities (16)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU60926 - Unrestricted Upload of File with Dangerous Type
CVE-2022-26149
CWE-434 Low
Available
No
- 01.03.2022 -
#VU36173 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-20755
CWE-79 Low
No
No
- 06.02.2019 -
#VU36174 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-20756
CWE-79 Low
No
No
- 06.02.2019 -
#VU36175 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-20757
CWE-79 Low
No
No
- 06.02.2019 -
#VU36615 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-17556
CWE-79 Low
No
No
- 26.09.2018 -
#VU37088 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-10382
CWE-79 Low
No
No
- 01.06.2018 -
#VU38632 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-11744
CWE-79 Low
No
No
- 30.07.2017 -
#VU38971 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2017-9067
CWE-22 Low
No
No
- 18.05.2017 -
#VU39103 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2017-8115
CWE-22 Medium
No
No
- 25.04.2017 -
#VU40993 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-8992
CWE-79 Low
No
No
- 22.12.2014 -
#VU41040 - Exposure of sensitive information to an unauthorized actor
CVE-2014-8775
CWE-200 Medium
Available
No
- 03.12.2014 -
#VU41041 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-8774
CWE-79 Low
Available
No
- 03.12.2014 -
#VU41042 - Cross-Site Request Forgery (CSRF)
CVE-2014-8773
CWE-352 Medium
Available
No
- 03.12.2014 -
#VU41753 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2014-2736
CWE-89 Medium
No
No
- 24.04.2014 -
#VU41929 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2014-2311
CWE-89 Medium
No
No
- 11.03.2014 -
#VU41984 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-2080
CWE-79 Low
No
No
- 01.03.2014 -