EUVD-2026-16134
GHSA-q8fm-q448-xc94
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in dameng100 muucmf 1.9.5.20260309. The impacted element is an unknown function of the file /admin/config/list.html. Performing a manipulation of the argument Name results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
A reflected cross-site scripting (XSS) vulnerability exists in dameng100 muucmf version 1.9.5.20260309 within the /admin/config/list.html endpoint, where the Name parameter is not properly sanitized before being rendered in the response. An unauthenticated remote attacker can craft a malicious URL containing JavaScript code in the Name parameter to execute arbitrary scripts in a victim's browser context, potentially leading to session hijacking, credential theft, or malware distribution. A public proof-of-concept exploit has been published, and the vendor has not responded to early disclosure notifications, indicating no immediate patch is available.
Technical ContextAI
This vulnerability is a reflected XSS attack (CWE-79: Improper Neutralization of Input During Web Page Generation) affecting the dameng100 muucmf web application framework, specifically version 1.9.5.20260309 as identified via CPE cpe:2.3:a:dameng100:muucmf. The vulnerable component is the administrative configuration listing functionality at /admin/config/list.html, which accepts user-controlled input via the Name parameter and fails to implement proper input validation or output encoding before rendering the parameter value back to the HTML response. This is a classic reflected XSS scenario where user input flows directly into the DOM without sanitization, allowing attackers to inject arbitrary HTML and JavaScript that executes in the context of authenticated users or administrators accessing the admin panel.
RemediationAI
Immediately contact dameng100 for security updates and patch availability for version 1.9.5.20260309; if patches are not forthcoming, evaluate migration to alternative products with active security support. As interim protective measures, implement a Web Application Firewall (WAF) with XSS detection rules to block requests containing suspicious characters or JavaScript payloads in the Name parameter, restrict network access to the /admin/config/list.html endpoint using IP whitelisting or VPN requirements, and enforce HTTP Content-Security-Policy (CSP) headers to limit script execution scope. Additionally, apply input validation and output encoding patches at the application level if source code access is available, or consult dameng100 technical support for interim security configurations. Monitor for indicators of compromise such as unusual admin panel access patterns or JavaScript injection attempts in logs.
SQL injection in dameng100 muucmf 1.9.5.20260309 allows remote unauthenticated attackers to compromise database confiden
Muucmf 1.9.5.20260309 contains a cross-site scripting (XSS) vulnerability in the /admin/extend/list.html endpoint where
A stored cross-site scripting (XSS) vulnerability exists in dameng100 muucmf version 1.9.5.20260309 and potentially earl
A reflected cross-site scripting (XSS) vulnerability exists in Dameng100 MUUCMF version 1.9.5.20260309 within the Member
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today