{"id":"CVE-2018-20756","aliases":["GHSA-fpxg-5x79-43rm"],"url":"https://o3.security/vulnerability/CVE-2018-20756","summary":"MODX Revolution allows XSS via document resources","details":"MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.","published":"2019-02-06T17:29:00.313Z","modified":"2026-07-08T17:17:49.787767Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"modx/revolution","fixedVersion":"2.7.1-pl"}],"fix":null,"references":[{"type":"FIX","url":"https://github.com/modxcms/revolution/issues/14105"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T17:17:49.787767Z"}}