base-admin CVE-2026-96810

Requires a low-privileged authenticated account (PR:L) on the huanzi-qch base-admin application capable of reaching the Add User handler (CommonController.java Save function) and supplying the Username argument. Exploitation is not self-contained: it needs victim interaction (UI:P) - a privileged user (typically an administrator) must subsequently view the page that renders the stored Username value for the payload to fire. Limiting factors: authentication is mandatory, a second user must view the tainted output, and there is no fixed release, so mitigation relies on manual input/output sanitization rather than an upgrade.

This is a genuinely low-to-moderate priority stored XSS. The CVSS 4.0 base of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P) already reflects meaningful friction: exploitation requires an authenticated account (PR:L) to submit a crafted Username, plus victim interaction (UI:P) - an administrator or other user must view the page that renders the malicious value. Impact is integrity-only and limited (VI:L; VC:N/VA:N), meaning no direct confidentiality or availability loss from the flaw itself. Public exploit code exists (E:P, confirmed by the GitHub write-up), which raises practical likelihood, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread or active exploitation. The E:P 'Proof-of-Concept' maturity is consistent with the POC-exists signal and does NOT indicate weaponization. Net: a real, verifiable bug with public POC, but gated by authentication and user interaction, in a low-footprint product - priority should be modest. Note the description does not clarify whether the XSS is reflected or stored, but the primary POC reference is explicitly titled 'Storage-Based XSS,' indicating stored/persistent XSS; treat as stored.

An attacker with a low-privileged authenticated account submits a new user via the Add User handler, placing a JavaScript payload in the Username field, which is stored without sanitization. When an administrator later opens the user-management page, the payload executes in the admin's browser session, enabling session/cookie theft or actions performed as the admin. A public proof-of-concept for this stored XSS is available on GitHub.