Majordomo
Products
1- 11 CVEs
Recent CVEs
11| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-33465 | Hig | 0.46 | 7.1 | 0.00 | Apr 30, 2024 | Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component. | ||
| CVE-2011-0063 | 0.10 | — | 0.85 | Mar 15, 2011 | The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to… | |||
| CVE-2023-50917 | Cri | 0.06 | 9.8 | 0.38 | Dec 15, 2023 | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager. | ||
| CVE-2026-27175 | Cri | 0.04 | 9.8 | 0.07 | Feb 18, 2026 | MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a… | ||
| CVE-2026-27174 | Cri | 0.04 | 9.8 | 0.07 | Feb 18, 2026 | MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing… | ||
| CVE-2026-27180 | Cri | 0.03 | 9.8 | 0.01 | Feb 18, 2026 | MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication… | ||
| CVE-2000-0037 | 0.03 | — | 0.01 | Dec 28, 1999 | Majordomo wrapper allows local users to gain privileges by specifying an alternate configuration file. | |||
| CVE-2026-27181 | Hig | 0.00 | 7.5 | 0.01 | Feb 18, 2026 | MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, making all mode-gated code paths… | ||
| CVE-2026-27178 | Hig | 0.00 | 7.2 | 0.00 | Feb 18, 2026 | MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default… | ||
| CVE-2026-27177 | Hig | 0.00 | 7.2 | 0.00 | Feb 18, 2026 | MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without… | ||
| CVE-2026-27176 | Med | 0.00 | 6.1 | 0.00 | Feb 18, 2026 | MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph… |
- risk 0.46cvss 7.1epss 0.00
Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component.
- CVE-2011-0063Mar 15, 2011risk 0.10cvss —epss 0.85
The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to…
- risk 0.06cvss 9.8epss 0.38
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
- risk 0.04cvss 9.8epss 0.07
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a…
- risk 0.04cvss 9.8epss 0.07
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing…
- risk 0.03cvss 9.8epss 0.01
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication…
- CVE-2000-0037Dec 28, 1999risk 0.03cvss —epss 0.01
Majordomo wrapper allows local users to gain privileges by specifying an alternate configuration file.
- risk 0.00cvss 7.5epss 0.01
MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, making all mode-gated code paths…
- risk 0.00cvss 7.2epss 0.00
MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default…
- risk 0.00cvss 7.2epss 0.00
MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without…
- risk 0.00cvss 6.1epss 0.00
MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph…