Vulnerabilities

31 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos

ShowKEV only Public PoC CVSS ≥ 9 CVSS ≥ 7 EPSS ≥ 10%EPSS ≥ 50%Window24h 7d 30d 90d All

StackAll WordPress E-commerce Drupal Joomla npm pip Maven Go Packagist RubyGems NuGet

Sortpublished epss cvss KEV date updated vendor: domainmod ✕

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2024-48622 +2 in the same advisory: …48623 …48624	A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid p A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid parameter. NVD description · AI analysis pending	6.6 group max	<1%	PoC	domainmod domainmod	—	Oct 15, 2024
CVE-2020-20988 +2 in the same advisory: …20990 …20989	A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HT A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter. NVD description · AI analysis pending	5.4 group max	1%	PoC	domainmod domainmod	—	Aug 12, 2021
CVE-2020-35358	DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality. NVD description · AI analysis pending	9.8	2%	PoC	domainmod domainmod	—	Mar 15, 2021
CVE-2019-9080	DomainMOD before 4.14.0 uses MD5 without a salt for password storage. DomainMOD before 4.14.0 uses MD5 without a salt for password storage. NVD description · AI analysis pending	7.5	<1%		domainmod domainmod	—	Oct 20, 2020
CVE-2020-12735	reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover. reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover. NVD description · AI analysis pending	9.8	2%	PoC	domainmod domainmod	—	May 8, 2020
CVE-2019-15811	In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS. In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS. NVD description · AI analysis pending	6.1	7%	PoC ×2	domainmod domainmod	—	Aug 29, 2019
CVE-2019-1010096 +2 in the same advisory: …1010095 …1010094	DomainMOD v4.10.0 is affected by: DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page. NVD description · AI analysis pending	8.8	<1%	PoC	domainmod domainmod	—	Jul 18, 2019
CVE-2018-1000856	DomainMOD version 4.09.03 and above. DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear to be exploitable via Victim must visit the vulnerable page. This vulnerability appears to have been fixed in No fix yet. NVD description · AI analysis pending	4.8	1%	PoC	domainmod domainmod	—	Dec 20, 2018
CVE-2018-20011 +2 in the same advisory: …20010 …20009	DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field. DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field. NVD description · AI analysis pending	4.8	4%	PoC ×2	domainmod domainmod	—	Dec 10, 2018
CVE-2018-19915 +3 in the same advisory: …19914 …19913 …19892	DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field. DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field. NVD description · AI analysis pending	4.8	4%	PoC ×2	domainmod domainmod	—	Dec 6, 2018
CVE-2018-19750 +3 in the same advisory: …19751 …19752 …19749	DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields. DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields. NVD description · AI analysis pending	5.4 group max	2%	PoC ×2	domainmod domainmod	—	Nov 29, 2018
CVE-2018-19136 +1 in the same advisory: …19137	DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter. DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter. NVD description · AI analysis pending	6.1	7%	PoC ×2	domainmod domainmod	—	Nov 9, 2018
CVE-2018-11559 +1 in the same advisory: …11558	DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter. DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter. NVD description · AI analysis pending	5.4	<1%	PoC	domainmod domainmod	—	May 30, 2018
CVE-2018-11404 +1 in the same advisory: …11403	DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter. DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter. NVD description · AI analysis pending	6.1 group max	2%	PoC	domainmod domainmod	—	May 24, 2018