Priority MEDIUM 57
In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS) vulnerability.
CVSS 3.1MEDIUM 5.3· Local · Low privileges · No interaction · EPSS 0.00222 · Published 2024-10-15 · No fix listed CWE-79
Priority MEDIUM 57
In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS).
CVSS 3.1MEDIUM 5.3· Local · Low privileges · No interaction · EPSS 0.00222 · Published 2024-10-15 · No fix listed CWE-79
Priority MEDIUM 64
A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid parameter.
CVSS 3.1MEDIUM 6.6· Local · Low privileges · No interaction · EPSS 0.00325 · Published 2024-10-15 · No fix listed CWE-79
Priority LOW 25
A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00595 · Published 2021-08-12 · No fix listed CWE-79
Priority LOW 21
A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00483 · Published 2021-08-12 · No fix listed CWE-352
Priority LOW 27
A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parame…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01331 · Published 2021-08-12 · No fix listed CWE-79
Priority MEDIUM 47
DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02432 · Published 2021-03-15 · No fix listed CWE-613
Priority LOW 34
DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00666 · Published 2020-10-20 · No fix listed CWE-916
Priority MEDIUM 45
reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01719 · Published 2020-05-08 · No fix listed CWE-331
Priority LOW 37
In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.06958 · Published 2019-08-29 · No fix listed CWE-79
Priority LOW 39
DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF).
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.0065 · Published 2019-07-18 · No fix listed CWE-352
Priority LOW 39
DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF).
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.0065 · Published 2019-07-18 · No fix listed CWE-352
Priority LOW 39
domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF).
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.0065 · Published 2019-07-18 · No fix listed CWE-352
Priority LOW 25
DomainMOD version 4.09.03 and above.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01424 · Published 2018-12-20 · No fix listed CWE-79
Priority LOW 29
DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.04428 · Published 2018-12-10 · No fix listed CWE-79
Priority LOW 29
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.04428 · Published 2018-12-10 · No fix listed CWE-79
Priority LOW 29
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.04428 · Published 2018-12-10 · No fix listed CWE-79
Priority LOW 29
DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.04008 · Published 2018-12-06 · No fix listed CWE-79
Priority LOW 28
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.03316 · Published 2018-12-06 · No fix listed CWE-79
Priority LOW 26
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01762 · Published 2018-12-06 · No fix listed CWE-79
Priority LOW 25
DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01514 · Published 2018-12-06 · No fix listed CWE-79
Priority LOW 28
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.03316 · Published 2018-11-29 · No fix listed CWE-79
Priority LOW 28
DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.03316 · Published 2018-11-29 · No fix listed CWE-79
Priority LOW 28
DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01796 · Published 2018-11-29 · No fix listed CWE-79
Priority LOW 28
DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.03316 · Published 2018-11-29 · No fix listed CWE-79
Load more
THREATIST.IORead the docs