彙總 domainmod 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 跨站腳本與CSRF 等問題，部分漏洞可能導致 工作階段劫持，並影響 生產負載與軟體部署 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2024-48624 | In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS) vulnerability. | [email protected] | 5.3 | 0.18% | 2024-10-15 | 2025-05-06 |
| CVE-2024-48623 | In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS). | [email protected] | 5.3 | 0.18% | 2024-10-15 | 2025-05-06 |
| CVE-2024-48622 | A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit.php and the cdfid parameter. | [email protected] | 6.6 | 0.61% | 2024-10-15 | 2025-05-06 |
| CVE-2020-20990 | A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter. | [email protected] | 5.4 | 0.28% | 2021-08-12 | 2024-11-21 |
| CVE-2020-20989 | A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs. | [email protected] | 4.3 | 0.14% | 2021-08-12 | 2024-11-21 |
| CVE-2020-20988 | A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter. | [email protected] | 5.4 | 2.33% | 2021-08-12 | 2024-11-21 |
| CVE-2020-35358 | DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality. | [email protected] | 9.8 | 1.48% | 2021-03-15 | 2024-11-21 |
| CVE-2019-9080 | DomainMOD before 4.14.0 uses MD5 without a salt for password storage. | [email protected] | 7.5 | 0.15% | 2020-10-20 | 2024-11-21 |
| CVE-2020-12735 | reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover. | [email protected] | 9.8 | 0.54% | 2020-05-08 | 2024-11-21 |
| CVE-2019-15811 | In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS. | [email protected] | 6.1 | 1.06% | 2019-08-29 | 2024-11-21 |
| CVE-2019-1010096 | DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page. | [email protected] | 8.8 | 0.14% | 2019-07-18 | 2024-11-21 |
| CVE-2019-1010095 | DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The component is: admin/users/add.php. The attack vector is: After the administrator logged in, open the html page. | [email protected] | 8.8 | 0.14% | 2019-07-18 | 2024-11-21 |
| CVE-2019-1010094 | domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component is: http://127.0.0.1/settings/password/ http://127.0.0.1/admin/users/add.php http://127.0.0.1/admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page. | [email protected] | 8.8 | 0.14% | 2019-07-18 | 2024-11-21 |
| CVE-2018-1000856 | DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear to be exploitable via Victim must visit the vulnerable page. This vulnerability appears to have been fixed in No fix yet. | [email protected] | 4.8 | 1.04% | 2018-12-20 | 2024-11-21 |
| CVE-2018-20011 | DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field. | [email protected] | 4.8 | 0.51% | 2018-12-10 | 2024-11-21 |
| CVE-2018-20010 | DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field. | [email protected] | 4.8 | 0.51% | 2018-12-10 | 2024-11-21 |
| CVE-2018-20009 | DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider.php SSL Provider Name or SSL Provider URL field. | [email protected] | 4.8 | 0.51% | 2018-12-10 | 2024-11-21 |
| CVE-2018-19915 | DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field. | [email protected] | 4.8 | 0.28% | 2018-12-06 | 2024-11-21 |
| CVE-2018-19914 | DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field. | [email protected] | 4.8 | 0.30% | 2018-12-06 | 2024-11-21 |
| CVE-2018-19913 | DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field. | [email protected] | 4.8 | 0.22% | 2018-12-06 | 2024-11-21 |