CVE-2017-9070: MODX Revolution cross-site scripting vulnerability

May 17, 2022 (updated April 22, 2025)

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.

References

citadelo.com/en/2017/04/modx-revolution-cms
github.com/advisories/GHSA-7hhg-xj2h-5vq9
github.com/modxcms/revolution
github.com/modxcms/revolution/pull/13415
nvd.nist.gov/vuln/detail/CVE-2017-9070

Code Behaviors & Features

Detect and mitigate CVE-2017-9070 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →