Mjdm

Majordomo

10 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2026-27180

Exploit
  • EPSS 61.82%
  • Veröffentlicht 18.02.2026 21:10:41
  • Zuletzt bearbeitet 20.02.2026 19:51:21

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint...

7.5

CVE-2026-27181

Exploit
  • EPSS 0.04%
  • Veröffentlicht 18.02.2026 21:10:41
  • Zuletzt bearbeitet 20.02.2026 19:51:48

MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, making...

9.8

CVE-2026-27179

Exploit
  • EPSS 0.07%
  • Veröffentlicht 18.02.2026 21:10:40
  • Zuletzt bearbeitet 20.02.2026 19:56:55

MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization ...

6.1

CVE-2026-27178

Exploit
  • EPSS 0.03%
  • Veröffentlicht 18.02.2026 21:10:39
  • Zuletzt bearbeitet 20.02.2026 19:58:33

MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-con...

6.1

CVE-2026-27177

Exploit
  • EPSS 0.03%
  • Veröffentlicht 18.02.2026 21:10:38
  • Zuletzt bearbeitet 20.02.2026 20:00:36

MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the...

6.1

CVE-2026-27176

Exploit
  • EPSS 0.03%
  • Veröffentlicht 18.02.2026 21:10:37
  • Zuletzt bearbeitet 20.02.2026 20:01:03

MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value a...

9.8

CVE-2026-27174

Exploit
  • EPSS 60.34%
  • Veröffentlicht 18.02.2026 21:10:36
  • Zuletzt bearbeitet 20.02.2026 20:02:36

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit state...

9.8

CVE-2026-27175

Exploit
  • EPSS 41.68%
  • Veröffentlicht 18.02.2026 21:10:36
  • Zuletzt bearbeitet 20.02.2026 20:02:13

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). Th...

7.1

CVE-2024-33465

  • EPSS 0.07%
  • Veröffentlicht 30.04.2024 15:15:53
  • Zuletzt bearbeitet 21.11.2024 09:17:00

Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component.

9.8

CVE-2023-50917

  • EPSS 92.22%
  • Veröffentlicht 15.12.2023 17:15:12
  • Zuletzt bearbeitet 21.11.2024 08:37:31

MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.