CVE-2026-27176 — MajorDoMo Reflected Cross-Site Scripting in command.php
MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page wi…
Published: 2026-02-18 · CVSS: 5.1 · CVSS 4.0
MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7