CVE-2020-12735

CRITICAL 9.8CVE-2020-12735 · Published 08/05/2020 · updated 17/06/2026

In short

CVE-2020-12735 is a CRITICAL (CVSS 9.8) vulnerability affecting domainmod (domainmod).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 77.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
domainmod domainmod	`= 4.13.0`	No fix yet

reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.