CVE-2024-48623

In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS).

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

0.22% chance of exploitation in the next 30 days, 12th percentile

Published

2024-10-15

Proof-of-concept exploits (2)

• domainmod/domainmod/issues/176600★ · 2026-10-06
• Leousum/POCFORGE1★ · 2025-10-08

References

• CVE Record
• NVD entry

Related

• CVE-2018-1000856
• CVE-2018-11558
• CVE-2018-11559
• CVE-2018-19749
• CVE-2018-19750
• CVE-2018-19751