CVE-2026-27176Medium· 6.1▾ TwilightPoC availableMajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 33.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
Nuclei ×1 (last check)
MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.
MajorDoMo <= *Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27177High· 7.2MajorDoMo Stored Cross-Site Scripting via Property Set Endpoint
CVE-2026-27178High· 7.2MajorDoMo Stored Cross-Site Scripting via Method Parameters to Shoutbox
CVE-2026-27174Critical· 9.8MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
CVE-2026-27180Critical· 9.8MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning
CVE-2026-27175Critical· 9.8MajorDoMo Command Injection in rc/index.php via Race Condition
CVE-2026-27179High· 8.2MajorDoMo Unauthenticated SQL Injection in Commands Module