CVE-2008-0094

Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arbitrary local files via a .. (dot dot) in the as_language parameter to assets/snippets/AjaxSearch/AjaxSearch.php, reached through index-ajax.php; and (2) read arbitrary local files via a .. (dot dot) in the file parameter to assets/js/htcmime.php.

• CWE-22

• http://modxcms.com/forums/index.php/topic%2C21290.0.html
• http://secunia.com/advisories/28220Patch, Vendor Advisory
• http://securityreason.com/securityalert/3522
• http://www.securityfocus.com/archive/1/485707/100/0/threaded
• http://www.securityfocus.com/bid/27096Exploit
• http://www.securityfocus.com/bid/27097Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39352
• http://modxcms.com/forums/index.php/topic%2C21290.0.html
• http://secunia.com/advisories/28220Patch, Vendor Advisory
• http://securityreason.com/securityalert/3522
• http://www.securityfocus.com/archive/1/485707/100/0/threaded
• http://www.securityfocus.com/bid/27096Exploit
• http://www.securityfocus.com/bid/27097Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39352

Published

Jan 8, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-0088Unspecified vulnerability in Active Directory on Microsoft W…
• CVE-2008-0089SQL injection vulnerability in uprofile.php in ClipShare all…
• CVE-2008-0090A certain ActiveX control in npUpload.dll in DivX Player 6.6…
• CVE-2008-0091Directory traversal vulnerability in download2.php in AGENCY…
• CVE-2008-0092Cross-site scripting (XSS) vulnerability in index.php in the…
• CVE-2008-0093Multiple cross-site scripting (XSS) vulnerabilities in newti…
• CVE-2008-0095The SIP channel driver in Asterisk Open Source 1.4.x before …
• CVE-2008-0096Multiple buffer overflows in Georgia SoftWorks SSH2 Server (…
• CVE-2008-0097Format string vulnerability in the log function in Georgia S…
• CVE-2008-0098Buffer overflow in RealPlayer 11 build 6.0.14.748 allows rem…
• CVE-2008-0099Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 an…
• CVE-2008-0100Stack-based buffer overflow in the Scene::errorf function in…