modx modx revolution

Name: modx modx revolution
Brand: modx

productUS

cpe:2.3:a:modx:modx_revolution:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

3critical12high21medium0low

updated 2026-10-27

vulnerabilities (36)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2010-5278US	medium4.3	18.6% (97th)	Exploit	no fix	2012-10-07	≤ 2.0.2
CVE-2014-8775US	medium5.0	2.76% (86th)	Exploit	no fix	2014-12-03	29 versions
CVE-2014-8774US	medium4.3	1.47% (73rd)	Exploit	no fix	2014-12-03	29 versions
CVE-2014-8773US	medium6.8	1.13% (66th)	Exploit	no fix	2014-12-03	29 versions
CVE-2018-1000207US	high7.2	64.1% (99th)	—	no fix	2018-07-13	≤ 2.6.4
CVE-2017-8115US	medium5.3	2.73% (86th)	—	no fix	2017-04-25	= 2.5.7
CVE-2020-25911US	critical9.1	2.38% (84th)	—	no fix	2021-10-31	= 2.7.3
CVE-2017-7324US	critical9.8	2.16% (82nd)	—	no fix	2017-03-30	≤ 2.5.4
CVE-2017-7321US	critical9.8	2.16% (82nd)	—	no fix	2017-03-30	≤ 2.5.4
CVE-2017-7323US	high8.1OT elevated	2.09% (82nd)	—	no fix	2017-03-30	≤ 2.5.4
CVE-2018-1000208US	high7.5	1.92% (80th)	—	no fix	2018-07-13	≤ 2.6.4
CVE-2016-10038US	high7.3	1.92% (80th)	—	no fix	2016-12-24	≤ 2.5.1-pl
CVE-2014-5451US	medium4.3	1.89% (79th)	—	no fix	2014-11-06	≤ 2.3.1
CVE-2014-2080US	medium4.3	1.89% (79th)	—	no fix	2014-03-01	26 versions
CVE-2017-9069US	high8.8	1.86% (79th)	—	no fix	2017-05-18	≤ 2.5.6
CVE-2016-10039US	high7.3	1.76% (78th)	—	2.5.2	2016-12-24	< 2.5.2
CVE-2016-10037US	high7.3	1.76% (78th)	—	2.5.2	2016-12-24	< 2.5.2
CVE-2014-8992US	medium4.3	1.40% (72nd)	—	no fix	2014-12-22	= 2.3.2
CVE-2017-7322US	high8.1	1.23% (69th)	—	no fix	2017-03-30	≤ 2.5.4
CVE-2014-2736US	high7.5	1.22% (69th)	—	no fix	2014-04-24	28 versions
CVE-2014-2311US	high7.5	1.21% (68th)	—	no fix	2014-03-11	27 versions
CVE-2015-6588US	medium6.1	1.20% (68th)	—	no fix	2017-08-29	≤ 1.9.0
CVE-2019-1010123US	high7.5	1.19% (68th)	—	no fix	2019-07-23	≤ 2.6.4
CVE-2017-7320US	medium6.1	0.87% (59th)	—	no fix	2017-03-30	≤ 2.5.4
CVE-2018-20757US	medium6.1	0.86% (58th)	—	no fix	2019-02-06	2 versions
CVE-2018-20756US	medium6.1	0.86% (58th)	—	no fix	2019-02-06	2 versions
CVE-2018-20755US	medium6.1	0.86% (58th)	—	no fix	2019-02-06	2 versions
CVE-2017-9067US	high7.0	0.82% (57th)	—	no fix	2017-05-18	= 2.5.6
CVE-2017-9068US	medium6.1	0.69% (52nd)	—	no fix	2017-05-18	≤ 2.5.6
CVE-2018-10382US	medium5.4	0.66% (51st)	—	no fix	2018-06-01	= 2.6.3
CVE-2017-9071US	medium4.7	0.65% (51st)	—	no fix	2017-05-18	≤ 2.5.6
CVE-2018-20758US	medium5.4	0.61% (49th)	—	no fix	2019-02-06	≤ 2.7.0
CVE-2017-11744US	medium6.1	0.60% (49th)	—	no fix	2017-07-30	= 2.5.7
CVE-2018-17556US	medium5.4	0.59% (48th)	—	no fix	2018-09-26	= 2.6.5
CVE-2017-9070US	medium5.4	0.56% (47th)	—	no fix	2017-05-18	≤ 2.5.6
CVE-2017-1000223US	medium5.4	0.50% (42nd)	—	no fix	2017-11-17	≤ 2.5.6

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')17 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')7 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type2 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-295Improper Certificate Validation1 CVEs
CWE-319Cleartext Transmission of Sensitive Information1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE36 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan