#Affected Vendor: http://modx.com/ #Date: 08/05/2015 #Creditee: http://osvdb.org/creditees/13518-vadodil-joel-varghese #Type of vulnerability: Multiple Cross Site Scripting Vulnerability #Tested on: Windows 8.1 #Product: MODX Revolution #Version: 2.3.3-pl "Content" field in create new resources ( http://localhost/modx/manager/?a=resource/create), "lexicon key" and "Description" field in create menu ( http://localhost/modx/manager/?a=system/action), "Name" and "Description" field in create dashboard ( http://localhost/modx/manager/?a=system/dashboards/create) The above mentioned fields were found to be vulnerable to Stored XSS. The PoC used is "><img src="blah.jpg" onerror="alert('XSS')"/>. Notified Vendor: 08/05/2015 No response received for the vendor Public Disclosure: 29/06/2015 -- Regards, *Joel V*