CVE-2026-27177High· 7.2▾ TwilightMajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stor…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without sanitization. When an administrator views the property editor in the admin panel, the stored values are rendered without escaping in both a paragraph tag (SOURCE field) and a textarea element (VALUE field). The XSS fires on page load without requiring any click from the admin. Additionally, the session cookie lacks the HttpOnly flag, enabling session hijack via document.cookie exfiltration. An attacker can enumerate properties via the unauthenticated /api.php/data/ endpoint and poison any property with malicious JavaScript.
MajorDoMo <= *Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27176Medium· 6.1MajorDoMo Reflected Cross-Site Scripting in command.php
CVE-2026-27178High· 7.2MajorDoMo Stored Cross-Site Scripting via Method Parameters to Shoutbox
CVE-2026-27174Critical· 9.8MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
CVE-2026-27180Critical· 9.8MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning
CVE-2026-27175Critical· 9.8MajorDoMo Command Injection in rc/index.php via Race Condition
CVE-2026-27179High· 8.2MajorDoMo Unauthenticated SQL Injection in Commands Module