Vulnerability · Published Feb 18, 2026 · Assigned by VulnCheck

CVE-2026-27179MajorDoMo Unauthenticated SQL Injection in Commands Module

High 8.2

In plain English

A high-severity SQL injection in MajorDoMo from sergejey. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.5%top 55.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parameterized queries. The commands module is loadable without authentication via the /objects/?module=commands endpoint, which includes arbitrary modules by name and calls their usual() method. Time-based blind SQL injection is exploitable using UNION SELECT SLEEP() syntax. Because MajorDoMo stores admin passwords as unsalted MD5 hashes in the users table, successful exploitation enables extraction of credentials and subsequent admin panel access.

Affected products (as reported)

Vendor	Product	Versions
sergejey	MajorDoMo	0 – through *

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

MajorDoMo Revisited: What I Missed in 2023 third-party-advisory
Fix PR: sergejey/majordomo#1177 issue-tracking
VulnCheck Advisory: MajorDoMo Unauthenticated SQL Injection in Commands Module third-party-advisory