https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:25:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329374 EUVD-2026-329374 https://cve.radiocsirt.org/vuln/euvd-2026-329374 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27181 <p>MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module&#39;s admin() method reads gr(&#39;mode&#39;) from $_REQUEST and assigns it to $this-&gt;mode at the start of execution, making all mode-gated code paths reachable without authentication via the /objects/?module=market endpoint. The uninstall mode handler calls uninstallPlugin(), which deletes module records from the database, executes the module&#39;s uninstall() method via eval(), recursively deletes the module&#39;s directory and template files using removeTree(), and removes associated cycle scripts. An attacker can iterate through module names and wipe the entire MajorDoMo installation with a series of unauthenticated GET requests.</p> <p>MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module&#39;s admin() method reads gr(&#39;mode&#39;) from $_REQUEST and assigns it to $this-&gt;mode at the start of execution, making all mode-gated code paths reachable without authentication via the /objects/?module=market endpoint. The uninstall mode handler calls uninstallPlugin(), which deletes module records from the database, executes the module&#39;s uninstall() method via eval(), recursively deletes the module&#39;s directory and template files using removeTree(), and removes associated cycle scripts. An attacker can iterate through module names and wipe the entire MajorDoMo installation with a series of unauthenticated GET requests.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27181 https://cve.radiocsirt.org/vuln/ghsa-5v24-5hr7-xg26 <p>MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module&#39;s admin() method reads gr(&#39;mode&#39;) from $_REQUEST and assigns it to $this-&gt;mode at the start of execution, making all mode-gated code paths reachable without authentication via the /objects/?module=market endpoint. The uninstall mode handler calls uninstallPlugin(), which deletes module records from the database, executes the module&#39;s uninstall() method via eval(), recursively deletes the module&#39;s directory and template files using removeTree(), and removes associated cycle scripts. An attacker can iterate through module names and wipe the entire MajorDoMo installation with a series of unauthenticated GET requests.</p> <p>MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module&#39;s admin() method reads gr(&#39;mode&#39;) from $_REQUEST and assigns it to $this-&gt;mode at the start of execution, making all mode-gated code paths reachable without authentication via the /objects/?module=market endpoint. The uninstall mode handler calls uninstallPlugin(), which deletes module records from the database, executes the module&#39;s uninstall() method via eval(), recursively deletes the module&#39;s directory and template files using removeTree(), and removes associated cycle scripts. An attacker can iterate through module names and wipe the entire MajorDoMo installation with a series of unauthenticated GET requests.</p> https://cve.radiocsirt.org/vuln/ghsa-5v24-5hr7-xg26