Domainmod

domainmod

31 CVEs • 1 product

Products (1)

Click to collapse

Toggle

Domainmod

domainmod

31 CVEs

CVEs (31)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-48624 1Domainmod 1Domainmod Jun 17, 2026 Oct 15, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS) vulnerability.
CVE-2024-48623 1Domainmod 1Domainmod Jun 17, 2026 Oct 15, 2024 N/A· v4 5.3 MEDIUM· v3 N/A· v2 In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS).
CVE-2024-48622 1Domainmod 1Domainmod Jun 17, 2026 Oct 15, 2024 N/A· v4 6.6 MEDIUM· v3 N/A· v2 A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid parameter.
CVE-2020-20990 1Domainmod 1Domainmod Jun 17, 2026 Aug 12, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter.
CVE-2020-20989 1Domainmod 1Domainmod Jun 17, 2026 Aug 12, 2021 N/A· v4 4.3 MEDIUM· v3 4.3 MEDIUM· v2 A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs.
CVE-2020-20988 1Domainmod 1Domainmod Jun 17, 2026 Aug 12, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parame...Show more A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter.Show less
CVE-2020-35358 1Domainmod 1Domainmod Jun 17, 2026 Mar 15, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire...Show more DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality.Show less
CVE-2019-9080 1Domainmod 1Domainmod Jun 17, 2026 Oct 20, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
CVE-2020-12735 1Domainmod 1Domainmod Jun 17, 2026 May 8, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover.
CVE-2019-15811 1Domainmod 1Domainmod Jun 17, 2026 Aug 29, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
CVE-2019-1010096 1Domainmod 1Domainmod Jun 17, 2026 Jul 18, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vect...Show more DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.Show less
CVE-2019-1010095 1Domainmod 1Domainmod Jun 17, 2026 Jul 18, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: admin/users/add.php. The attack vector is: After...Show more DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: admin/users/add.php. The attack vector is: After the administrator logged in, open the html page.Show less
CVE-2019-1010094 1Domainmod 1Domainmod Jun 17, 2026 Jul 18, 2019 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/adm...Show more domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.Show less
CVE-2018-1000856 1Domainmod 1Domainmod Nov 21, 2024 Dec 20, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be e...Show more DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear to be exploitable via Victim must visit the vulnerable page. This vulnerability appears to have been fixed in No fix yet.Show less
CVE-2018-20011 1Domainmod 1Domainmod Nov 21, 2024 Dec 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field.
CVE-2018-20010 1Domainmod 1Domainmod Nov 21, 2024 Dec 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
CVE-2018-20009 1Domainmod 1Domainmod Nov 21, 2024 Dec 10, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
CVE-2018-19915 1Domainmod 1Domainmod Nov 21, 2024 Dec 6, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
CVE-2018-19914 1Domainmod 1Domainmod Nov 21, 2024 Dec 6, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
CVE-2018-19913 1Domainmod 1Domainmod Nov 21, 2024 Dec 6, 2018 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.

12 Next