CVE-2026-27179

CVE-2026-27179 is an unauthenticated SQL injection vulnerability in MajorDoMo (Major Domestic Module), specifically within the commands module. This critical vulnerability (CVSS 9.8) allows an attacker to inject malicious SQL queries due to improper sanitization of the $_GET['parent'] parameter in commands_search.inc.php, accessible without authentication. Successful exploitation enables time-based blind SQL injection to extract unsalted MD5 admin password hashes, leading to full administrative panel access and complete compromise of the system. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, including mentions of a fix addressing this and other security issues.