Vulnerability · Published Feb 18, 2026 · Assigned by VulnCheck

CVE-2026-27174MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval

Critical 9.8

In plain English

A critical-severity code injection in MajorDoMo from sergejey. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 6.9% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)6.9%top 5.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling3Metasploit, Nuclei, Public PoC

Official description

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

Affected products (as reported)

Vendor	Product	Versions
sergejey	MajorDoMo	0 – through *

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

MajorDoMo Revisited: What I Missed in 2023 third-party-advisory
Fix PR: sergejey/majordomo#1177 issue-tracking
VulnCheck Advisory: MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval third-party-advisory