CVE-2026-27176

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27176
MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://chocapikk.com/posts/2026/majordomo-revisited/ Third Party Advisory Exploit
https://github.com/sergejey/majordomo/pull/1177 Issue Tracking Exploit
https://www.vulncheck.com/advisories/majordomo-reflected-cross-site-scripting-in-commandphp Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*
History

20 Feb 2026, 20:01

Type Values Removed Values Added
References () https://chocapikk.com/posts/2026/majordomo-revisited/ - () https://chocapikk.com/posts/2026/majordomo-revisited/ - Third Party Advisory, Exploit
References () https://github.com/sergejey/majordomo/pull/1177 - () https://github.com/sergejey/majordomo/pull/1177 - Issue Tracking, Exploit
References () https://www.vulncheck.com/advisories/majordomo-reflected-cross-site-scripting-in-commandphp - () https://www.vulncheck.com/advisories/majordomo-reflected-cross-site-scripting-in-commandphp - Third Party Advisory
First Time Mjdm
Mjdm majordomo
Summary
  • (es) MajorDoMo (también conocido como Major Domestic Module) contiene una vulnerabilidad de cross-site scripting (XSS) reflejada en command.PHP. El parámetro $qry se renderiza directamente en la página HTML sin sanitización a través de htmlspecialchars(), tanto en un atributo de valor de campo de entrada como en un elemento de párrafo. Un atacante puede inyectar JavaScript arbitrario al crear una URL con contenido malicioso en el parámetro qry.
CPE cpe:2.3:a:mjdm:majordomo:-:*:*:*:*:*:*:*

18 Feb 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-18 22:16

Updated : 2026-02-20 20:01

NVD link : CVE-2026-27176

Mitre link : CVE-2026-27176

CVE.ORG link : CVE-2026-27176

JSON object : View

Products Affected

mjdm

  • majordomo
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')