CVE-2017-9068

CVE-2017-9068 describes a Reflected Cross-Site Scripting (XSS) vulnerability in MODX Revolution versions prior to 2.5.7. Attackers can inject malicious payloads into fields on the setup page, specifically demonstrated via the database_type parameter, to execute arbitrary scripts in a user's browser. This vulnerability has a CVSS v3 score of 6.1 (Medium), indicating it can be exploited over the network with low attack complexity, requiring user interaction, and potentially impacting confidentiality and integrity. The EPSS score is very low, suggesting a minimal likelihood of exploitation. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has garnered no community discussion or media coverage, further indicating a lack of widespread attention or exploitation.