CVE-2026-27174: MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
sergejey · MajorDoMo
Vendor fix available · Affected: sergejey MajorDoMo · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 94% of scored CVEs
DescriptionCVE.org
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- sergejey · MajorDoMo0
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- MajorDoMo - Unauthenticated RCE · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- sergejey
- Published
- February 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-27174 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.