CVE-2024-48623

In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected Cross Site Scripting (XSS).

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

0.22% chance of exploitation in the next 30 days, 13th percentile

Published

2024-10-15

Proof-of-concept exploits (2)

• domainmod/domainmod/issues/176
• Leousum/POCFORGE

References

• CVE Record
• NVD entry

Related

• CVE-2018-1000856
• CVE-2018-11558
• CVE-2018-11559
• CVE-2018-19749
• CVE-2018-19750
• CVE-2018-19751