Domainmod: >> Domainmod >> 4.10.0 Security Vulnerabilities
A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid parameter.
CVSS Score
6.6
EPSS Score
0.004
Published
2024-10-15
In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS).
CVSS Score
5.3
EPSS Score
0.002
Published
2024-10-15
In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS) vulnerability.
CVSS Score
5.3
EPSS Score
0.002
Published
2024-10-15
DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
CVSS Score
7.5
EPSS Score
0.001
Published
2020-10-20
In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
CVSS Score
6.1
EPSS Score
0.052
Published
2019-08-29
domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.
CVSS Score
8.8
EPSS Score
0.001
Published
2019-07-18
DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: admin/users/add.php. The attack vector is: After the administrator logged in, open the html page.
CVSS Score
8.8
EPSS Score
0.001
Published
2019-07-18
DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page.
CVSS Score
8.8
EPSS Score
0.001
Published
2019-07-18
DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear to be exploitable via Victim must visit the vulnerable page. This vulnerability appears to have been fixed in No fix yet.
CVSS Score
4.8
EPSS Score
0.012
Published
2018-12-20
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field.
CVSS Score
4.8
EPSS Score
0.004
Published
2018-12-10
Page 1