Dashboard / CVE-2026-27179

CVE-2026-27179

HIGH 1 PoC
MEDIUM Priority: 0.05 BB Relevance: 88/100
Published: 2026-02-18 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: None
VC: High
VI: Low
VA: None

Description

MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parameterized queries. The commands module is loadable without authentication via the /objects/?module=commands endpoint, which includes arbitrary modules by name and calls their usual() method. Time-based blind SQL injection is exploitable using UNION SELECT SLEEP() syntax. Because MajorDoMo stores admin passwords as unsalted MD5 hashes in the users table, successful exploitation enables extraction of credentials and subsequent admin panel access.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
sergejey MajorDoMo 0

References & Advisories (3)

Proof of Concept (1)

—
https://github.com/p3Nt3st3r-sTAr/MajorDoMo-CVE-2026-27179
nomi-sec

Bug Bounty Relevance

88 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

8.8 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.53%
Raw Score 0.005270
Percentile 45.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00527
2026-11-12
0.00527
2026-11-10
0.00527
2026-11-09
0.00527
2026-11-08
0.00527

Intelligence Sources

mitre ref →

External Links