Vulnerability · Published Feb 18, 2026 · Assigned by VulnCheck

CVE-2026-27176MajorDoMo Reflected Cross-Site Scripting in command.php

Medium 6.1

In plain English

A medium-severity cross-site scripting in MajorDoMo from sergejey. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.

Affected products (as reported)

Vendor	Product	Versions
sergejey	MajorDoMo	0 – through *

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

MajorDoMo Revisited: What I Missed in 2023 third-party-advisory
Fix PR: sergejey/majordomo#1177 issue-tracking
VulnCheck Advisory: MajorDoMo Reflected Cross-Site Scripting in command.php third-party-advisory