Description
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | modx/revolution | < 2.5.7 | 2.5.7 | GHSA-7hhg-xj2h-5vq9 |