CVE-2017-7320

setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.

• CWE-79

• http://www.securityfocus.com/bid/97228Third Party Advisory, VDB Entry
• https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdfExploit, Technical Description, Third Party Advisory
• http://www.securityfocus.com/bid/97228Third Party Advisory, VDB Entry
• https://mazinahmed.net/services/public-reports/ModX%20-%20Responsible%20Disclosure%20-%20January%202017.pdfExploit, Technical Description, Third Party Advisory

Published

Mar 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7314An issue was discovered in Personify360 e-Business 7.5.2 thr…
• CVE-2017-7315An issue was discovered on Humax Digital HG100R 2.0.6 device…
• CVE-2017-7316An issue was discovered on Humax Digital HG100R 2.0.6 device…
• CVE-2017-7317An issue was discovered on Humax Digital HG100 2.0.6 devices…
• CVE-2017-7318Siklu EtherHaul devices before 7.4.0 are vulnerable to a rem…
• CVE-2017-7319Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-7321setup/controllers/welcome.php in MODX Revolution 2.5.4-pl an…9.8
• CVE-2017-7322The (1) update and (2) package-installation features in MODX…8.1
• CVE-2017-7323The (1) update and (2) package-installation features in MODX…8.1
• CVE-2017-7324setup/templates/findcore.php in MODX Revolution 2.5.4-pl and…9.8
• CVE-2017-7325Yandex Browser before 16.9.0 allows remote attackers to spoo…
• CVE-2017-7326Race condition issue in Yandex Browser for Android before 17…