i7MEDIA/mojoportal

i7MEDIA/mojoportal

www.mojoportal.com

Releases9

Frequency1 year 2 months

Last Release 10 months ago

Stars210

mojoPortal is an extensible, cross database, mobile friendly, web content management system (CMS) and web application framework written in C# ASP.NET.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-69770 ↗	Feb 13, 2026Friday, 13 February 2026, 18:16	10 CRITICAL	—
A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.
CVE-2025-28367 ↗	Apr 21, 2025Monday, 21 April 2025, 16:15	6.5 MEDIUM	—
mojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey.
CVE-2023-24322 ↗	Feb 9, 2023Thursday, 9 February 2023, 20:15	6.1 MEDIUM	—
A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters.
CVE-2023-24323 ↗	Feb 9, 2023Thursday, 9 February 2023, 20:15	8.8 HIGH	—
Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.
CVE-2023-24687 ↗	Feb 9, 2023Thursday, 9 February 2023, 20:15	5.4 MEDIUM	—
Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Settings component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtCompanyName parameter.
CVE-2018-7447 ↗	Feb 24, 2018Saturday, 24 February 2018, 02:29	—	3.5 LOW
mojoPortal through 2.6.0.0 is prone to multiple persistent cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. The 'Title' and 'Subtitle' fields of the 'Blog' page are vulnerable. NOTE: The software maintainer disputes this as a vulnerability because the fields claimed to be vulnerable to XSS are only available to administrators who are supposed to have access to add scripts
CVE-2017-1000457 ↗	Jan 2, 2018Tuesday, 2 January 2018, 18:29	—	3.5 LOW
Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or "Content Administrators" role.