PT-2026-20514 · Majordomo · Majordomo

Valentin Lobstein · Publicado 2026-02-18 · Atualizado 2026-02-19 · CVE-2026-27178

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MajorDoMo versions (affected versions not specified)

Description The software contains a stored cross-site scripting (XSS) issue through method parameter injection into the shoutbox. The /objects/?method= API endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default methods, such as ThisComputer.VolumeLevelChanged(), pass the user-supplied VALUE parameter directly into the say() function, which stores the message raw in the shouts database table without escaping. The shoutbox widget renders stored messages without sanitization in both PHP rendering code and HTML templates. The dashboard widget auto-refreshes every 3 seconds, causing the injected script to execute automatically when an administrator loads the dashboard, potentially enabling session hijack through cookie exfiltration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-27178

Produtos afetados

Majordomo

Referências · 6

• 🔥 https://github.com/sergejey/majordomo/pull/1177 · Exploit
• 🔥 https://chocapikk.com/posts/2026/majordomo-revisited · Exploit
• https://twitter.com/CVEnew/status/2024258082298351962 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27178 · Nota de Segurança
• https://vulncheck.com/advisories/majordomo-stored-cross-site-scripting-via-method-parameters-to-shoutbox · Nota
• https://twitter.com/VulmonFeeds/status/2024325433831911688 · Publicação no Twitter