https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-27181.htmlhttps://patchthecve.com/cve/CVE-2026-27181.htmlWed, 17 Jun 2026 10:26:48 +0000HIGH 7.5: MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, making all mode-gated code paths reachable without authehttps://patchthecve.com/cve/CVE-2026-27180.htmlhttps://patchthecve.com/cve/CVE-2026-27180.htmlWed, 17 Jun 2026 10:26:48 +0000CRITICAL 9.8: MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode')https://patchthecve.com/cve/CVE-2026-27179.htmlhttps://patchthecve.com/cve/CVE-2026-27179.htmlWed, 17 Jun 2026 10:26:48 +0000HIGH 8.2: MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or parameterized queries. The commands module is lhttps://patchthecve.com/cve/CVE-2026-27178.htmlhttps://patchthecve.com/cve/CVE-2026-27178.htmlWed, 17 Jun 2026 10:26:48 +0000HIGH 7.2: MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability through method parameter injection into the shoutbox. The /objects/?method= endpoint allows unauthenticated execution of stored methods with attacker-controlled parameters. Default methods such as ThisCohttps://patchthecve.com/cve/CVE-2026-27177.htmlhttps://patchthecve.com/cve/CVE-2026-27177.htmlWed, 17 Jun 2026 10:26:48 +0000HIGH 7.2: MajorDoMo (aka Major Domestic Module) contains a stored cross-site scripting (XSS) vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without sanitization. When an administrahttps://patchthecve.com/cve/CVE-2026-27176.htmlhttps://patchthecve.com/cve/CVE-2026-27176.htmlWed, 17 Jun 2026 10:26:48 +0000MEDIUM 6.1: MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars(), both in an input field value attribute and in a paragraph element. An attacker chttps://patchthecve.com/cve/CVE-2026-27175.htmlhttps://patchthecve.com/cve/CVE-2026-27175.htmlWed, 17 Jun 2026 10:26:47 +0000CRITICAL 9.8: MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safhttps://patchthecve.com/cve/CVE-2026-27174.htmlhttps://patchthecve.com/cve/CVE-2026-27174.htmlWed, 17 Jun 2026 10:26:47 +0000CRITICAL 9.8: MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach t