The vulnerability is a stored cross‑site scripting flaw in MajorDoMo. The /objects/?method= endpoint accepts attacker‑controlled parameters without validation, and default methods such as ThisComputer.VolumeLevelChanged forward the supplied VALUE directly to the say() function. This value is stored in the shouts database table unescaped. The shoutbox widget then renders these messages without sanitization, meaning any injected script runs automatically when an administrator visits the dashboard. This allows delivery of malicious code that can exfiltrate session cookies, enabling session hijack.

MajorDoMo, also known as Major Domestic Module, provided by sergejey. The CVE does not specify a restricted version range, so all installations that include the affected shoutbox functionality are potentially impacted. The flaw exists in the web interface that serves the dashboard and shoutbox widget.

The flaw scores 5.3 on the CVSS scale and has an EPSS of less than 1 %. It is not listed in the CISA KEV catalog. An attacker can exploit the issue remotely by injecting malicious HTML into the shoutbox via the public /objects/?method= endpoint. The payload will run automatically on the next dashboard refresh, which occurs every three seconds, meaning an attacker only needs an administrator to view the dashboard to succeed. Although the flaw requires the victim to have an authenticated session, the impact is modest but could lead to session hijack if the administrator’s session cookie is stolen. The low exploitation probability reflects the specific angle needed for success.