What is the CVSS score of CVE-2026-27178?

CVE-2026-27178 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-27178?

Yes, a public proof-of-concept exploit is available for CVE-2026-27178. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27178?

Within 24 hours: Identify all MajorDoMo instances in your environment and assess internet accessibility; isolate internet-facing instances or restrict access via network controls. Within 7 days: Implement WAF rules blocking requests to /objects/?method= containing suspicious parameters; disable the shoutbox feature if not business-critical. Within 30 days: Evaluate alternative solutions or contact vendor for patched versions; conduct security code review of custom method implementations; perform user audit for evidence of exploitation.

Majordomo CVE-2026-27178

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-18 disclosure@vulncheck.com

PHP XSS Majordomo Mjdm

7.2

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted HTTP request to /objects/?method= endpoint
Delivery

Inject malicious JavaScript in VALUE parameter
Exploit

Stored XSS payload persists in shouts database
Execution

Shoutbox renders unescaped payload to all users
Impact

Execute arbitrary JavaScript in victim browsers

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	MajorDoMo installation with shoutbox widget enabled and accessible via /objects/?method= endpoint. No authentication required. Exploitation leverages default ThisComputer.VolumeLevelChanged method accepting attacker-controlled VALUE parameter without input validation or output escaping in database storage and HTML rendering.
Impact	CVSS 7.2 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. Public exploit/POC available.
Exploit ScenarioDerived	An attacker without authentication could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

MajorDomo's shoutbox feature is vulnerable to stored XSS due to unsanitized user input in the /objects/?method= endpoint, allowing unauthenticated attackers to inject malicious scripts that persist in the database. When administrators access the auto-refreshing dashboard, the stored payload executes automatically, enabling session hijacking and cookie theft. Public exploit code exists for this vulnerability, and no patch is currently available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 7.2

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects the method component of Majordomo. MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default methods such as ThisComputer.VolumeLevelChanged pass the user-supplied VALUE parameter directly into the say() function, which stores the message raw in the shouts database table without escaping. The shoutbox widget rende

Know when Majordomo gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Feb 20, 2026 - 19:58 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 22:16 nvd

HIGH 7.2

DescriptionCVE.org

MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default methods such as ThisComputer.VolumeLevelChanged pass the user-supplied VALUE parameter directly into the say() function, which stores the message raw in the shouts database table without escaping. The shoutbox widget renders stored messages without sanitization in both PHP rendering code and HTML templates. Because the dashboard widget auto-refreshes every 3 seconds, the injected script executes automatically when any administrator loads the dashboard, enabling session hijack through cookie exfiltration.

Executive ViewAI

Why It Matters

MajorDoMo installations are vulnerable to stored cross-site scripting attacks that allow unauthenticated attackers to inject malicious code affecting all users who access the shoutbox feature. This vulnerability poses an immediate risk to user data confidentiality, session hijacking, and potential lateral movement within affected systems, particularly if MajorDoMo is internet-facing or used in multi-tenant environments.

Business Impact: High

Compensating Controls

Implement Web Application Firewall (WAF) rules to block or sanitize /objects/?method= requests with suspicious parameter values; disable shoutbox functionality if not essential; restrict network access to MajorDoMo administration interfaces via IP whitelisting or VPN; implement strict input validation and output encoding at the application layer if source code access is available; monitor application logs for /objects/?method= requests with encoded or obfuscated payloads; apply defense-in-depth with Content Security Policy (CSP) headers to limit XSS impact.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.