Modx Revolution
Vendor:
First CVE: Oct 7, 2012 · Active for 13 years
36
Total CVEs
More Total CVEs than 97% of tracked products
5.1
Avg CVEs / Year
Higher CVE frequency than 89% of tracked products
6.5
Avg CVSS
Higher Avg CVSS than 29% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Modx Revolution over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 7, 2012
13 years ago
Most Recent CVE
Oct 31, 2021
1,728 days ago
CVE Severity & Scoring
Modx Revolution36 CVEs
58%
33%
8%
All CVEs352,708 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (2.8%)
Network26 (72.2%)
Unknown9 (25.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low23 (63.9%)
High4 (11.1%)
Unknown9 (25.0%)
User Interaction
None14 (38.9%)
Unknown9 (25.0%)
Required13 (36.1%)
Privileges Required
Low7 (19.4%)
High1 (2.8%)
None19 (52.8%)
Unknown9 (25.0%)
Top CVEs
Signals from CVEs in this product scope (36 CVEs).
36 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-1000207HIGH MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating f | Jul 13, 2018 | 7.2 | 59 | NO | NO |
CVE-2010-5278MEDIUM Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remot | Oct 7, 2012 | 4.3 | 40 | NO | YES |
CVE-2017-7324CRITICAL setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter. | Mar 30, 2017 | 9.8 | 33 | NO | NO |
CVE-2017-7321CRITICAL setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?acti | Mar 30, 2017 | 9.8 | 32 | NO | NO |
CVE-2020-25911CRITICAL A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service ( | Oct 31, 2021 | 9.1 | 29 | NO | NO |
CVE-2017-9069HIGH In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess. | May 18, 2017 | 8.8 | 27 | NO | NO |
CVE-2017-7323HIGH The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof | Mar 30, 2017 | 8.1 | 27 | NO | NO |
CVE-2017-7322HIGH The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attac | Mar 30, 2017 | 8.1 | 26 | NO | NO |
CVE-2014-8773MEDIUM MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long stri | Dec 3, 2014 | 6.8 | 26 | NO | YES |
CVE-2016-10038HIGH Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir par | Dec 24, 2016 | 7.3 | 25 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (36 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
2.8% of CVEs· 96th percentile
ExploitDB
4 CVEs
11.1% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (36 CVEs).
Media Mentions
Signals from CVEs in this product scope (36 CVEs).
Top CNAs Publishing CVEs For Modx Revolution
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.7.3 | 1 | 9.1 | 2.3% | 0 | 0 |
| 2.7.0 | 3 | 6.1 | 0.9% | 0 | 0 |
| 2.6.5 | 1 | 5.4 | 0.6% | 0 | 0 |
| 2.6.3 | 1 | 5.4 | 0.7% | 0 | 0 |
| 2.5.7 | 2 | 5.7 | 1.6% | 0 | 0 |
| 2.5.6 | 1 | 7.0 | 0.9% | 0 | 0 |
| 2.3.2 | 1 | 4.3 | 1.4% | 0 | 0 |
| 2.2.9 | 6 | 5.9 | 1.6% | 0 | 3 |
| 2.2.8 | 6 | 5.9 | 1.6% | 0 | 3 |
| 2.2.7 | 6 | 5.9 | 1.6% | 0 | 3 |
| 2.2.6 | 6 | 5.9 | 1.6% | 0 | 3 |
| 2.2.5 | 6 | 5.9 | 1.6% | 0 | 3 |
| 2.2.4 | 6 | 5.9 | 1.6% | 0 | 3 |
| 2.2.3 | 6 | 5.9 | 1.6% | 0 | 3 |
| 2.2.2 | 6 | 5.9 | 1.6% | 0 | 3 |
| 2.2.14 | 3 | 5.4 | 1.8% | 0 | 3 |
| 2.2.13 | 3 | 5.4 | 1.8% | 0 | 3 |
| 2.2.12 | 5 | 6.2 | 1.6% | 0 | 3 |
| 2.2.11 | 5 | 6.2 | 1.6% | 0 | 3 |
| 2.2.10 | 5 | 6.2 | 1.6% | 0 | 3 |