cve-2026-27174

{
  "cvss": 0.0,
  "datePublished": "2026-04-18T00:00:00Z",
  "dateUpdated": "2026-04-18T00:00:00Z",
  "description": "MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.",
  "dueDate": "",
  "id": "CVE-2026-27174",
  "kev_catalogs": [
    "vulncheck"
  ],
  "knownRansomwareCampaignUse": "Unknown",
  "product": "majordomo",
  "requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
  "severity": "HIGH",
  "source": "vulncheck_kev",
  "title": "mjdm majordomo Improper Control of Generation of Code",
  "vendor": "mjdm"
}