Sergejey vulnerabilities
We track 5 vulnerabilities in Sergejey products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on February 18, 2026.
Latest Sergejey vulnerabilities
- 7.5 High severity
MajorDoMo: Missing Authorization
MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, making all mode-
- 9.8 Critical severity
MajorDoMo: Download of Code Without Integrity Check
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without a
- 9.8 Critical severity
MajorDoMo: Improper Neutralization of Special Elements used in an SQL Command
MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitization or paramet
- 9.8 Critical severity
MajorDoMo: Improper Neutralization of Special Elements used in an OS Command
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command
- 9.8 Critical severity
MajorDoMo: Improper Control of Generation of Code
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allo