GitHub Advisoryadvisory · Packagist

GHSA-fpxg-5x79-43rm MODX Revolution allows XSS via document resources

MEDIUM Published 2022-05-14 Modified 2025-07-11 Official page ↗
Aliases
CVE-2018-20756
Ecosystem
Packagist
Packages
modx/revolution
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-07-11

Affected packages

• Packagist modx/revolution: < 2.7.1-pl → fixed in 2.7.1-pl

Description

MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.

Related

Alias · CVE (1)

  • CVE-2018-20756 MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References