CVE-2026-27176

MEDIUM 6.1

MajorDoMo Reflected Cross-Site Scripting in command.php

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.

CWE	CWE-79
Vendor	sergejey
Product	majordomo
Published	Feb 18, 2026
Last Updated	Mar 5, 2026

Stay Ahead of the Next One

Get instant alerts for sergejey majordomo

Be the first to know when new medium vulnerabilities affecting sergejey majordomo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

sergejey / MajorDoMo

0 ≤ *

References

NVD ↗ CVE.org ↗ EPSS Data ↗

chocapikk.com: https://chocapikk.com/posts/2026/majordomo-revisited/ github.com: https://github.com/sergejey/majordomo/pull/1177 vulncheck.com: https://www.vulncheck.com/advisories/majordomo-reflected-cross-site-scripting-in-commandphp

Credits

Valentin Lobstein