A reflected cross‑site scripting flaw exists in the MajorDoMo home‑automation platform, located in command.php. The input parameter $qry is incorporated into the HTML output without proper sanitization and is rendered in both an input field and a paragraph element. This allows an attacker to embed arbitrary JavaScript in a URL that, when visited, is executed in the context of the user’s browser, potentially leading to credential theft, session hijacking, or defacement.

The vulnerability affects installations of the MajorDoMo system, specifically the community project managed by the sergejey vendor. No version numbers are listed in the CNA data, so any deployment that has not yet applied the recent patch referenced in the official pull request could be exposed.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by crafting and directing a victim to a URL that includes malicious content in the qry parameter, a method that requires no authentication and can be performed over an unauthenticated web connection.