CVE-2020-20988: 
DomainMOD vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was identified in Domainmod version 4.13, specifically in the /domains/cost-by-owner.php component. The vulnerability was assigned CVE-2020-20988 and was initially recorded on August 13, 2020 (CVE Details).

The vulnerability allows attackers to execute arbitrary web scripts or HTML through a crafted payload in the 'or Expiring Between' parameter. The vulnerability has been assessed with a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it received a base score of 3.5 (Low) with the vector string (AV:N/AC:M/Au:S/C:N/I:P/A:N). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When successfully exploited, this vulnerability allows attackers to inject and execute malicious web scripts or HTML code in the context of other users' browsers who access the affected component. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (NVD).