GCVE - cpe:2.3:a:modx:modx_revolution:2.2.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:modx:modx_revolution:2.2.9:*:*:*:*:*:*:*

part: a version: 2.2.9 update: *

Vendor	Modx (`ad4d3009-275e-5405-86b6-7a71a51694e5`)
Product	Modx Revolution (`9f041fb3-9c5f-5cd3-a040-a43b4b44ec62`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/modxcms/revolution`	purl2cpe	2026-06-01 10:12:38.529377

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-8775`	vulnerable	2026-06-08 05:06:10.153732	Details available MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. Published: 2014-12-03T18:00:00.000Z Updated: 2024-08-06T13:26:02.611Z Open on db.gcve.eu Reference links http://hacktivity.websecgeeks.com/modx-csrf-and-xss/ http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8774`	vulnerable	2026-06-08 05:06:10.152507	Details available Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key parameter. Published: 2014-12-03T18:00:00.000Z Updated: 2024-08-06T13:26:02.578Z Open on db.gcve.eu Reference links http://hacktivity.websecgeeks.com/modx-csrf-and-xss/ http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8773`	vulnerable	2026-06-08 05:06:10.148506	Details available MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter. Published: 2014-12-03T18:00:00.000Z Updated: 2024-08-06T13:26:02.580Z Open on db.gcve.eu Reference links http://hacktivity.websecgeeks.com/modx-csrf-and-xss/ http://forums.modx.com/thread/92152/critical-login-xss-csrf-revolution-2-2-1-4-and-prior	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2736`	vulnerable	2026-06-08 05:05:29.719330	Details available Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php. Published: 2014-04-24T14:00:00.000Z Updated: 2024-08-06T10:21:36.048Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/66990 http://secunia.com/advisories/58036 http://archives.neohapsis.com/archives/bugtraq/2014-04/0124.html http://forums.modx.com/thread/90173/modx-revolution-2-2-13-and-prior-blind-sql-injection	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2311`	vulnerable	2026-06-08 05:05:28.404644	Details available SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Published: 2014-03-11T15:00:00.000Z Updated: 2024-08-06T10:06:00.233Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2014/03/09/3 http://forums.modx.com/thread/89486/modx-revolution-2-x-sql-injection http://modx.com/blog/2014/03/07/revolution-2.2.13/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2080`	vulnerable	2026-06-08 05:05:27.529941	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.