Skip to content
OpenAdvisories

Vendor

sergejey

8 known vulnerabilities.

Products

MajorDoMo 8
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2026-27181

    MajorDoMo Unauthenticated Module Uninstall via Market Endpoint

    MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, making all mode…

    sergejey MajorDoMo
  • High 8.2
    CVE-2026-27179 Public exploit

    MajorDoMo Unauthenticated SQL Injection in Commands Module

    MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parame…

    sergejey MajorDoMo
  • High 7.2
    CVE-2026-27178

    MajorDoMo Stored Cross-Site Scripting via Method Parameters to Shoutbox

    MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled p…

    sergejey MajorDoMo
  • High 7.2
    CVE-2026-27177

    MajorDoMo Stored Cross-Site Scripting via Property Set Endpoint

    MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database…

    sergejey MajorDoMo