CVE-2026-27177

MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without sanitization. When an administrator views the property editor in the admin panel, the stored values are rendered without escaping in both a paragraph tag (SOURCE field) and a textarea element (VALUE field). The XSS fires on page load without requiring any click from the admin. Additionally, the session cookie lacks the HttpOnly flag, enabling session hijack via document.cookie exfiltration. An attacker can enumerate properties via the unauthenticated /api.php/data/ endpoint and poison any property with malicious JavaScript.

• CWE-79

• https://chocapikk.com/posts/2026/majordomo-revisited/Exploit, Third Party Advisory
• https://github.com/sergejey/majordomo/pull/1177Exploit, Issue Tracking
• https://www.vulncheck.com/advisories/majordomo-stored-cross-site-scripting-via-property-set-endpointThird Party Advisory

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27171zlib before 1.3.2 allows CPU consumption via crc32_combine64…5.5
• CVE-2026-27172The ConsulRegistry in the camel-consul component (class org.…8.8
• CVE-2026-27173JWT tokens that were used by workers in Kubernetes Executors…8.7
• CVE-2026-27174MajorDoMo (aka Major Domestic Module) allows unauthenticated…9.8
• CVE-2026-27175MajorDoMo (aka Major Domestic Module) is vulnerable to unaut…9.8
• CVE-2026-27176MajorDoMo (aka Major Domestic Module) contains a reflected c…6.1
• CVE-2026-27178MajorDoMo (aka Major Domestic Module) contains a stored cros…6.1
• CVE-2026-27179MajorDoMo (aka Major Domestic Module) contains an unauthenti…9.8
• CVE-2026-2718The Dealia – Request a Quote plugin for WordPress is vulnera…6.4
• CVE-2026-27180MajorDoMo (aka Major Domestic Module) is vulnerable to unaut…9.8
• CVE-2026-27181MajorDoMo (aka Major Domestic Module) allows unauthenticated…8.7
• CVE-2026-27182Saturn Remote Mouse Server contains a command injection vuln…8.6