What is the CVSS score of CVE-2026-27176?

CVE-2026-27176 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-27176?

CVE-2026-27176 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 6.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

Is there a public PoC exploit available for CVE-2026-27176?

Yes, a public proof-of-concept exploit is available for CVE-2026-27176. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27176?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-27176

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-02-18 disclosure@vulncheck.com

PHP XSS Majordomo

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 20, 2026 - 20:01 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

MEDIUM 6.1

DescriptionCVE.org

MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.

Articles & Coverage 1

vulnerability.circl.lu MajorDoMo Multiple Critical RCE Vulnerabilities (CVE-2026-27174 to CVE-2026-27181) Feb 19, 2026

AnalysisAI

Reflected XSS in MajorDoMo's command.php allows remote attackers to inject arbitrary JavaScript through an unsanitized qry parameter, affecting users who click malicious links. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the qry component of Majordomo. MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker can inject arbitrary JavaScript by crafting a URL with malicious content in the qry parameter.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.