{"id":"CVE-2026-27174","title":"MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval","summary":"MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-94"],"vendor":"sergejey","product":"MajorDoMo","affected":["MajorDoMo <= *"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-02-25T18:21:10.869875Z"},"exploitAvailable":true,"published":"2026-02-18","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:01:36.940Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-27174","references":[{"url":"https://chocapikk.com/posts/2026/majordomo-revisited/","label":"MajorDoMo Revisited: What I Missed in 2023"},{"url":"https://github.com/sergejey/majordomo/pull/1177","label":"Fix PR: sergejey/majordomo#1177"},{"url":"https://www.vulncheck.com/advisories/majordomo-unauthenticated-remote-code-execution-via-admin-console-eval","label":"VulnCheck Advisory: MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval"}],"tags":["cve.org","exploit-available"],"epss":0.06853,"epssPercentile":0.94083,"exploits":{"github":1,"githubRepos":["https://github.com/MaxMnMl/majordomo-CVE-2026-27174-poc"],"metasploit":["exploit/multi/http/majordomo_console_eval_rce"],"nuclei":["CVE-2026-27174"],"checkedAt":"2026-11-08T14:51:57.351Z"},"ingestedAt":"2026-11-08T14:51:22.468Z","slug":"CVE-2026-27174","body":"## Overview\n\nMajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.\n\n## Affected\n\n- `MajorDoMo <= *`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":53.9,"likelihood":1.4,"exploitation":12,"ransomware":0},"changes":[]}