EUVD-2026-16118Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown function of the file /admin/Member/index.html. This manipulation of the argument Search causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
A reflected cross-site scripting (XSS) vulnerability exists in Dameng100 MUUCMF version 1.9.5.20260309 within the Member management interface at /admin/Member/index.html. The vulnerability is triggered via an unsanitized Search parameter, allowing remote attackers to inject arbitrary JavaScript that executes in the context of an authenticated user's browser. A proof-of-concept exploit has been publicly disclosed, and the vendor has not responded to early disclosure attempts, leaving deployments unpatched.
Technical ContextAI
This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). The affected product is Dameng100 MUUCMF (muucmf), identified via CPE cpe:2.3:a:dameng100:muucmf:*:*:*:*:*:*:*:*, which appears to be a content management or administrative framework. The root cause is insufficient input validation and output encoding on the Search parameter in the Member administration interface. The web application accepts user-supplied input in the Search field and reflects it back into the HTML response without proper sanitization or encoding, allowing an attacker to break out of the intended context and inject malicious script tags or event handlers.
RemediationAI
Immediate action requires applying input validation and output encoding controls at the application level. Since no vendor patch is available, the primary mitigation is to upgrade to a patched version if released by Dameng100 (check https://vuldb.com/?submit.776174 for updates), or if unavailable, restrict access to the /admin/Member/index.html interface to trusted IP ranges using network-level controls (firewall rules, reverse proxy ACLs). Additionally, implement Web Application Firewall (WAF) rules to detect and block XSS payloads in the Search parameter, enforce Content Security Policy (CSP) headers to limit script execution, and ensure all administrator accounts use strong authentication with multi-factor authentication. As a longer-term solution, migrate to an alternative product or wait for the vendor to release security updates; if continued use is necessary, apply manual code patching to sanitize the Search parameter using context-appropriate encoding (HTML entity encoding for reflected content).
SQL injection in dameng100 muucmf 1.9.5.20260309 allows remote unauthenticated attackers to compromise database confiden
Muucmf 1.9.5.20260309 contains a cross-site scripting (XSS) vulnerability in the /admin/extend/list.html endpoint where
A reflected cross-site scripting (XSS) vulnerability exists in dameng100 muucmf version 1.9.5.20260309 within the /admin
A stored cross-site scripting (XSS) vulnerability exists in dameng100 muucmf version 1.9.5.20260309 and potentially earl
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today