MajorDoMo - Cross-Site Scripting
CVE-2026-27176
Verified
Description
MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL.
Severity
Medium
CVSS Score
6.1
Exploit Probability
1%
Published Date
May 4, 2026
Template Author
dhiyaneshdk
CVE-2026-27176.yaml
6.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2026-27176
CWE ID:
cwe-79
Remediation Steps
Sanitize the $qry parameter using htmlspecialchars() or equivalent before rendering.