Muucmf EUVD-2026-16118

The CVSS v3.1 score of 4.3 reflects a low-to-moderate severity rating with network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and user interaction required (UI:R). However, this score underestimates real-world risk due to several aggravating factors: the CVSS vector explicitly marks this as Proof-of-Concept Exploit Available (E:P), the vulnerability is publicly disclosed with functional exploit code, and the vendor's non-response indicates no patch is forthcoming. The exploitation requires only user interaction (clicking a malicious link), which is readily achievable in social engineering scenarios targeting administrators. The low CVSS score reflects the limited impact scope (integrity only, no confidentiality or availability impact), but the combination of network accessibility, no authentication requirement, proven public exploit code, and unpatched status elevates practical risk. This is NOT a low-priority issue despite the moderate CVSS score-it represents an actively exploitable flaw in a web administrative interface with no vendor remediation available.

An attacker crafts a malicious URL containing JavaScript code embedded in the Search parameter (e.g., /admin/Member/index.html?Search=<script>alert('XSS')</script>) and sends it to an administrator via spear-phishing email or social engineering. When the administrator clicks the link while already authenticated to the MUUCMF administrative panel, the injected script executes in their browser with administrator privileges, potentially allowing the attacker to steal session cookies, perform unauthorized administrative actions, or redirect the administrator to a credential harvesting page. The public proof-of-concept exploit code available on GitHub (thinhneee.github.io) significantly lowers the barrier to weaponization, making this vulnerability a high-priority target for opportunistic attackers.