DomainMOD Security Vulnerabilities

CVE-2019-15811

In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has...

CVE-2018-1000856

DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear.....

CVE-2018-19137

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid...

CVE-2018-11558

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_first_name...

CVE-2018-11559

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name...

CVE-2020-20990

A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name...

CVE-2020-20988

A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between"...

CVE-2020-20989

A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete...

CVE-2020-35358

DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to....

CVE-2019-9080

DomainMOD before 4.14.0 uses MD5 without a salt for password...

CVE-2020-12735

reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account...

CVE-2019-1010094

domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack...

CVE-2019-1010095

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: admin/users/add.php. The attack vector is: After the administrator logged in, open the html...

CVE-2019-1010096

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html...

CVE-2018-20009

DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL...

CVE-2018-20011

DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder...

CVE-2018-20010

DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username...

CVE-2018-19913

DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes...

CVE-2018-19914

DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes...

CVE-2018-19915

DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL...

CVE-2018-19892

DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName...

CVE-2018-19750

DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain...

CVE-2018-19749

DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name...

CVE-2018-19752

DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the...

CVE-2018-19751

DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL...

CVE-2018-19136

DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid...

CVE-2018-11403

DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid...

CVE-2018-11404

DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid...