Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parameterized queries. The commands module is loadable without authentication via the /objects/?module=commands endpoint, which includes arbitrary modules by name and calls their usual() method. Time-based blind SQL injection is exploitable using UNION SELECT SLEEP() syntax. Because MajorDoMo stores admin passwords as unsalted MD5 hashes in the users table, successful exploitation enables extraction of credentials and subsequent admin panel access.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-27179 SQL Injection in MajorDoMo Commands Module Enabling Unauthenticated Admin Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27179
Post summary
CVE-2026-27179 is an SQL injection vulnerability in MajorDoMo's Commands Module that allows unauthenticated users to gain admin access; the post merely discloses the flaw without providing PoC, exploit, or patch information.
CVE-2026-27179 MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interp… https://www.cve.org/CVERecord?id=CVE-2026-27179
Post summary
A new unauthenticated SQL injection vulnerability has been disclosed in MajorDoMo’s commands module, with no known exploitation or mitigation details reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mjdm | majordomo | - | - | - |