phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

Is modx/revolution vulnerable?

Composer modx/revolution has 14 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.

14advisories
1critical
0on CISA KEV
2no fix recorded
CVETitleSeverityCVSSAffectedFixed in
CVE-2018-1000207MODX Revolution Incorrect Access Control vulnerabilityhigh7.2<2.7.02.7.0
CVE-2022-26149Unrestricted Upload of File with Dangerous Type in MODX Revolutionhigh7.2<=2.8.3-pl–
CVE-2020-25911XML External Entity vulnerability in MODX CMScritical9.1<2.8.02.8.0
CVE-2017-9069MODX Revolution allows overwriting .htaccesshigh8.8<2.5.72.5.7
CVE-2017-1000067MODX Revolution blind SQL injectionhigh8.8>=2.0.0 and <2.6.02.6.0
CVE-2018-20755MODX Revolution vulnerable to XSS attack through its User Photo fieldmedium6.1<2.7.1-pl2.7.1-pl
CVE-2018-20756MODX Revolution allows XSS via document resourcesmedium6.1<2.7.1-pl2.7.1-pl
CVE-2018-20757MODX Revolution allows XSS through extended user fieldsmedium6.1<2.7.1-pl2.7.1-pl
CVE-2017-9067MODX Revolution Directory Traversal Vulnerabilityhigh7.0<2.5.72.5.7
CVE-2017-9068MODX Revolution Reflected XSSmedium6.1<2.5.72.5.7
CVE-2017-9071MODX Revolution XSS via HTTP Host headermedium4.7<2.5.72.5.7
CVE-2018-20758MODX vulnerability allows for XSS via user settings parametersmedium5.4<2.7.1-pl2.7.1-pl
CVE-2017-9070MODX Revolution cross-site scripting vulnerabilitymedium5.4<2.5.72.5.7
CVE-2025-28010MODX allows cross-site scripting (XSS) via an SVG filemedium5.4<=3.1.0–

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs   How findings are ranked
A version is vulnerable when it falls inside an affected range and below the fixed version. phpwarden applies these ranges to the exact versions in your lockfile or install, so you only see what applies to you.