Default credentials

DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter...

CVE-2018-19137

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter...

CVE-2018-19137

DomainMOD 4.11.01 is vulnerable to a reflected cross-site scripting (XSS) flaw in assets/edit/ip-address.php via the ipid parameter. Successful exploitation could allow injected JavaScript to run in the victim’s browser, enabling session hijacking or page defacement. The issue stems from improper...

CVE-2018-19136

DomainMOD 4.11.01 is vulnerable to reflected cross-site scripting through assets/edit/registrar-account.php?raid=… due to insufficient input sanitization of the raid parameter. This can allow an attacker to execute arbitrary JavaScript in a victim’s browser, potentially enabling session hijacking...

CVE-2018-19137

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter...

CVE-2018-19136

DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter...

CVE-2018-19136

DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter...

CVE-2018-19137

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter...

CVE-2018-19137: Improper Neutralization of Input During Web Page Generation

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter...

CVE-2018-19136: Improper Neutralization of Input During Web Page Generation

DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter...

PT-2018-14828

Name of the Vulnerable Software and Affected Versions DomainMOD versions prior to 4.11.02 Description The issue allows for XSS via the ipid parameter in the "assets/edit/ip-address.php" endpoint. Recommendations For DomainMOD versions prior to 4.11.02, update to version 4.11.02 or later to resolv...

PT-2018-14827

Name of the Vulnerable Software and Affected Versions DomainMOD versions prior to 4.11.02 Description The issue allows for XSS via the raid parameter in the "assets/edit/registrar-account.php" endpoint. Recommendations For DomainMOD versions prior to 4.11.02, update to version 4.11.02 or later to...

CVE-2018-11559

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newlastname parameter...

CVE-2018-11558

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newfirstname parameter...

Cross site scripting

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newlastname parameter...

Cross site scripting

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newfirstname parameter...

CVE-2018-11559

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newlastname parameter...

CVE-2018-11558

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newfirstname parameter...

CVE-2018-11559

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newlastname parameter...

CVE-2018-11559

DomainMod 4.10.0 is affected by a Stored XSS in the profile settings endpoint (/settings/profile/index.php) via the new_last_name parameter. Root cause: persistent injection in the user profile handling leading to script execution when viewed. Impact is limited to what the XSS allows per the sour...