165 matches found
PT-2026-20511
MajorDoMo aka Major Domestic Module is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg. The command is inserted into a database queue by safe...
MajorDoMo 代码注入漏洞
MajorDoMo is an open-source DIY smart home automation platform developed by the MajorDoMo community. There is a code injection vulnerability in MajorDoMo. This vulnerability stems from an error in the inclusion order of modules/panel.class.php, which causes the execution to continue after a...
CVE-2026-27179: Improper Neutralization of Special Elements used in an SQL Command
MajorDoMo aka Major Domestic Module contains an unauthenticated SQL injection vulnerability in the commands module. The commandssearch.inc.php file directly interpolates the $GET'parent' parameter into multiple SQL queries without sanitization or parameterized queries. The commands module is...
CVE-2026-27180: Download of Code Without Integrity Check
MajorDoMo aka Major Domestic Module is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin method through the /objects/?module=saverestore endpoint without authentication because it uses gr'mode'...
CVE-2026-27174: Improper Control of Generation of Code
MajorDoMo aka Major Domestic Module allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect call that lacks an exit statement, allowing unauthenticated requests to reach th...
MajorDoMo 安全漏洞
MajorDoMo is an open-source DIY smart home automation platform developed by the MajorDoMo community. There is a security vulnerability in MajorDoMo. This vulnerability stems from the saverestore module, which exposes its admin method through the /objects/?module=saverestore endpoint without...
MajorDoMo Supply Chain RCE via Update Poisoning
This module exploits an unauthenticated remote code execution vulnerability in MajorDoMo's saverestore module via supply chain poisoning. The saverestore module's admin method is reachable without authentication through the /objects/?module=saverestore endpoint because usual calls admin directly...
MajorDoMo Remote Command Injection via cycle_execs Race Condition
This module exploits an unauthenticated command injection vulnerability in MajorDoMo's remote command handler rc/index.php. The param parameter is interpolated into double quotes without escapeshellarg, and the resulting string is passed to safeexec which inserts it into the safeexecs database...
PT-2026-20510
Name of the Vulnerable Software and Affected Versions MajorDoMo affected versions not specified Description An include order bug in modules/panel.class.php allows execution to continue past a redirect call that lacks an exit statement. This enables unauthenticated requests to reach the ajax handl...
CVE-2026-27177: Improper Neutralization of Input During Web Page Generation
MajorDoMo aka Major Domestic Module contains a stored cross-site scripting XSS vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without sanitization. When an administrat...
CVE-2023-50917
MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager...
CVE-1999-0207
Remote attacker can execute commands through Majordomo using the Reply-To field and a "lists" command...
VulnCheck KEV: CVE-2023-50917
MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager...
EUVD-1999-1201
Malware in sbrugna...
EUVD-2003-1357
Malware in sbrugna...
EUVD-2000-0035
Malware in sbrugna...
EUVD-2000-0037
Malware in sbrugna...
EUVD-2010-0376
Malware in sbrugna...