CVE-2026-27176 MajorDoMo Reflected Cross-Site Scripting in command.php

Medium 5.1 Published 18 Feb 2026 Updated 23 Jun 2026

Attackers can execute arbitrary JavaScript in MajorDoMo via reflected XSS in command.php, potentially leading to session hijacking or malicious actions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-27176?

CVE-2026-27176 is a medium-severity cross-site scripting vulnerability in sergejey MajorDoMo, published on 18 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.

Weakness: CWE-79

Which versions are affected by CVE-2026-27176?

It affects 1 product.

Products include Mjdm Majordomo.

How do I fix CVE-2026-27176?

No fix has been published for CVE-2026-27176 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-27176 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27176 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-rpq9-4jjf-2xhh.