CVE-2026-4845
Cross-Site Scripting in dameng100 muucmf /admin/Member#index.html
Publication date: 2026-03-26
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dameng | muucmf | 1.9.5.20260309 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4845 is a Reflected Cross-Site Scripting (XSS) vulnerability found in Muucmf T6 CMS version 1.9.5.20260309. It exists in the /admin/Member/index.html endpoint, specifically in the search parameter.
The vulnerability occurs because the input from the search parameter is directly inserted into the HTML input tag without any filtering or sanitization. This allows a remote attacker to inject arbitrary JavaScript code that executes in the context of the victim's browser session when the crafted URL is accessed.
This means an attacker can craft a URL containing malicious script code in the search parameter, and when a user accesses this URL, the script runs in their browser.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary JavaScript in the victim's browser session.
- Session hijacking, where attackers steal user session tokens to impersonate the user.
- Defacement or manipulation of the web page content viewed by the user.
- Execution of malicious actions on behalf of the user, potentially leading to further compromise.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the `/admin/Member/index.html` endpoint for reflected cross-site scripting (XSS) in the `search` parameter.
A common detection method is to send a crafted HTTP request with an XSS payload in the `search` parameter and observe if the payload is reflected and executed in the response.
- Use curl to send a test request with a simple XSS payload, for example: curl -i "http://<target>/admin/Member/index.html?search=<script>alert('XSS')</script>"
- Check the response HTML for the presence of the injected script tag or payload.
- Alternatively, use a web vulnerability scanner that supports XSS detection targeting the `search` parameter on the specified endpoint.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include sanitizing and validating the input received in the `search` parameter to prevent injection of malicious scripts.
If you are unable to patch the vulnerability immediately, consider implementing a Web Application Firewall (WAF) to block malicious payloads targeting the `search` parameter.
Additionally, restrict access to the `/admin/Member/index.html` endpoint to trusted users or IP addresses to reduce exposure.
Monitor logs for suspicious requests containing script tags or unusual input in the `search` parameter.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a reflected Cross-Site Scripting (XSS) flaw that allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking and other malicious actions.
Such vulnerabilities can impact compliance with standards like GDPR and HIPAA because they may lead to unauthorized access or exposure of sensitive personal or health information through session hijacking or other attacks exploiting the XSS flaw.
Therefore, organizations using the affected software could face risks related to data confidentiality and integrity, which are core requirements in these regulations.