CVE-2026-27174

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

• CWE-94

• https://chocapikk.com/posts/2026/majordomo-revisited/Exploit, Third Party Advisory
• https://github.com/sergejey/majordomo/pull/1177Exploit, Issue Tracking
• https://www.vulncheck.com/advisories/majordomo-unauthenticated-remote-code-execution-via-admin-console-evalThird Party Advisory

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27169OpenSift is an AI study tool that sifts through large datase…8.9
• CVE-2026-2717The HTTP Headers plugin for WordPress is vulnerable to CRLF …5.5
• CVE-2026-27170OpenSift is an AI study tool that sifts through large datase…7.1
• CVE-2026-27171zlib before 1.3.2 allows CPU consumption via crc32_combine64…5.5
• CVE-2026-27172The ConsulRegistry in the camel-consul component (class org.…8.8
• CVE-2026-27173JWT tokens that were used by workers in Kubernetes Executors…8.7
• CVE-2026-27175MajorDoMo (aka Major Domestic Module) is vulnerable to unaut…9.8
• CVE-2026-27176MajorDoMo (aka Major Domestic Module) contains a reflected c…6.1
• CVE-2026-27177MajorDoMo (aka Major Domestic Module) contains a stored cros…6.1
• CVE-2026-27178MajorDoMo (aka Major Domestic Module) contains a stored cros…6.1
• CVE-2026-27179MajorDoMo (aka Major Domestic Module) contains an unauthenti…9.8
• CVE-2026-2718The Dealia – Request a Quote plugin for WordPress is vulnera…6.4