CVE-2026-27179High· 8.2▾ MidnightPoC availableMajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
1 GitHub repo (last check)
MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parameterized queries. The commands module is loadable without authentication via the /objects/?module=commands endpoint, which includes arbitrary modules by name and calls their usual() method. Time-based blind SQL injection is exploitable using UNION SELECT SLEEP() syntax. Because MajorDoMo stores admin passwords as unsalted MD5 hashes in the users table, successful exploitation enables extraction of credentials and subsequent admin panel access.
MajorDoMo <= *Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27174Critical· 9.8MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
CVE-2026-27180Critical· 9.8MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning
CVE-2026-27176Medium· 6.1MajorDoMo Reflected Cross-Site Scripting in command.php
CVE-2026-27175Critical· 9.8MajorDoMo Command Injection in rc/index.php via Race Condition
CVE-2026-27181High· 7.5MajorDoMo Unauthenticated Module Uninstall via Market Endpoint
CVE-2026-27177High· 7.2MajorDoMo Stored Cross-Site Scripting via Property Set Endpoint