sergejey has 8 CVEs on record. The busiest recent month was February 2026 with 8. The median CVSS is 7.8 (high), with 3 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-79 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2026-27175Critical· 9.8MajorDoMo Command Injection in rc/index.php via Race Condition67CVE-2026-27174Critical· 9.8MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval67CVE-2026-27180Critical· 9.8MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning66CVE-2026-27179High· 8.2MajorDoMo Unauthenticated SQL Injection in Commands Module57CVE-2026-27181High· 7.5MajorDoMo Unauthenticated Module Uninstall via Market Endpoint53
sergejey vulnerabilities
CVEs affecting sergejey, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-27174Critical· 9.8PoCMajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks …
CVE-2026-27180Critical· 9.8PoCMajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saveres…
CVE-2026-27176Medium· 6.1PoCMajorDoMo Reflected Cross-Site Scripting in command.php
MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input …
CVE-2026-27175Critical· 9.8PoCMajorDoMo Command Injection in rc/index.php via Race Condition
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapes…
CVE-2026-27179High· 8.2PoCMajorDoMo Unauthenticated SQL Injection in Commands Module
MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without …
CVE-2026-27177High· 7.2MajorDoMo Stored Cross-Site Scripting via Property Set Endpoint
MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stor…
CVE-2026-27181High· 7.5PoCMajorDoMo Unauthenticated Module Uninstall via Market Endpoint
MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of exec…
CVE-2026-27178High· 7.2MajorDoMo Stored Cross-Site Scripting via Method Parameters to Shoutbox
MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with…