Base Admin
Monthly
Stored cross-site scripting in huanzi-qch base-admin lets a low-privileged authenticated user inject script through the Username argument of the Add User handler (CommonController.java Save), which then executes in the browser of any user - typically an administrator - who later views the tainted page. Exploitation requires a valid low-privileged account plus victim interaction (viewing the rendered username), and publicly available exploit code exists; no confirmed active exploitation is indicated (no CISA KEV listing). Because the project ships via continuous rolling releases, no fixed version has been published and the vendor did not respond to the disclosure.
Stored cross-site scripting in huanzi-qch base-admin lets a low-privileged authenticated user inject script through the Username argument of the Add User handler (CommonController.java Save), which then executes in the browser of any user - typically an administrator - who later views the tainted page. Exploitation requires a valid low-privileged account plus victim interaction (viewing the rendered username), and publicly available exploit code exists; no confirmed active exploitation is indicated (no CISA KEV listing). Because the project ships via continuous rolling releases, no fixed version has been published and the vendor did not respond to the disclosure.