DomainMOD

Records31All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

DomainMOD records in CISA KEV

No DomainMOD vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Domainmod 31 records MEDIUM

Records

31 records in Domainmod · all components

TI-2024-32438 CVE-2024-48622 · GHSA-4377-w6r6-fpff

A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to…

MEDIUM 64

A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid parameter.

CVSS 3.1MEDIUM 6.6 Local Low privileges No interaction EPSS 0.00325 Published 2024-10-15 No fix listed CWE-79

TI-2024-32440 CVE-2024-48624 · GHSA-h83f-w3v7-qh8v

In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request…

MEDIUM 57

In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00222 Published 2024-10-15 No fix listed CWE-79

TI-2024-32439 CVE-2024-48623 · GHSA-jfq3-w7wv-4v3g

In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in…

MEDIUM 57

In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS).

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00222 Published 2024-10-15 No fix listed CWE-79

TI-2020-17953 CVE-2020-35358 · GHSA-8ff6-grvw-rmvx

DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration…

MEDIUM 47

DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02432 Published 2021-03-15 No fix listed CWE-613

TI-2020-10123 CVE-2020-12735 · GHSA-4xrq-chxw-6p75

reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover.

MEDIUM 45

reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01719 Published 2020-05-08 No fix listed CWE-331

TI-2019-15976 CVE-2019-1010096 · GHSA-j9ww-4hxw-w7x5

Cross-site request forgery in DomainMOD

LOW 39

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF).

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0065 Published 2019-07-18 No fix listed CWE-352

TI-2019-15975 CVE-2019-1010095 · GHSA-j8x7-w249-3r8p

Cross-site request forgery in DomainMOD

LOW 39

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF).

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0065 Published 2019-07-18 No fix listed CWE-352

TI-2019-15974 CVE-2019-1010094 · GHSA-546p-wp48-mhxq

Cross-site request forgery in DomainMOD

LOW 39

domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF).

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0065 Published 2019-07-18 No fix listed CWE-352

TI-2019-11879 CVE-2019-15811 · GHSA-gv4g-f3rq-ww87

In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.

LOW 37

In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.06958 Published 2019-08-29 No fix listed CWE-79

TI-2018-13570 CVE-2018-19136 · GHSA-vq6j-f4x9-rwg7

DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.

LOW 37

DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.06623 Published 2018-11-09 No fix listed CWE-79

TI-2019-06556 CVE-2019-9080 · GHSA-j297-6q2p-5j3j

DomainMOD before 4.14.0 uses MD5 without a salt for password storage.

LOW 34

DomainMOD before 4.14.0 uses MD5 without a salt for password storage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00666 Published 2020-10-20 No fix listed CWE-916

TI-2018-13571 CVE-2018-19137 · GHSA-rfw6-ghcg-7jp5

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.

LOW 33

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02878 Published 2018-11-09 No fix listed CWE-79

TI-2018-08133 CVE-2018-11404 · GHSA-7gmm-fwgm-7v9g

DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.

LOW 32

DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02217 Published 2018-05-24 No fix listed CWE-79

TI-2018-14190 CVE-2018-20011 · GHSA-gjg4-3pmx-3jqr

DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.

LOW 29

DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.04428 Published 2018-12-10 No fix listed CWE-79

TI-2018-14189 CVE-2018-20010 · GHSA-438c-f5p2-jch8

DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.

LOW 29

DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.04428 Published 2018-12-10 No fix listed CWE-79

TI-2018-14188 CVE-2018-20009 · GHSA-wv4r-gxg7-q9cj

DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.

LOW 29

DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.04428 Published 2018-12-10 No fix listed CWE-79

TI-2018-14110 CVE-2018-19915 · GHSA-8cp3-mfpg-3vcf

DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.

LOW 29

DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.04008 Published 2018-12-06 No fix listed CWE-79

TI-2018-14109 CVE-2018-19914 · GHSA-p634-vvch-x26f

DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.

LOW 28

DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.03316 Published 2018-12-06 No fix listed CWE-79

TI-2018-13981 CVE-2018-19752 · GHSA-99r9-v28w-9qr9

DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.

LOW 28

DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.03316 Published 2018-11-29 No fix listed CWE-79

TI-2018-13980 CVE-2018-19751 · GHSA-cx2q-w5m9-hj67

DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.

LOW 28

DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.03316 Published 2018-11-29 No fix listed CWE-79

TI-2018-13979 CVE-2018-19750 · GHSA-p86m-fr3f-pv77

DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add…

LOW 28

DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01796 Published 2018-11-29 No fix listed CWE-79

TI-2018-13978 CVE-2018-19749 · GHSA-p8mf-x5q9-pgf9

DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.

LOW 28

DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.03316 Published 2018-11-29 No fix listed CWE-79

TI-2018-08132 CVE-2018-11403 · GHSA-pcrf-mgfc-87h9

DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.

LOW 28

DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01699 Published 2018-05-24 No fix listed CWE-79

TI-2020-13961 CVE-2020-20988 · GHSA-f3p7-hvgr-f35j

A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of…

LOW 27

A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parame…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01331 Published 2021-08-12 No fix listed CWE-79

TI-2018-14108 CVE-2018-19913 · GHSA-7x8x-cj7f-whrv

DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.

LOW 26

DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.01762 Published 2018-12-06 No fix listed CWE-79

Open these records in search →