Compliance Impact

The vulnerability is a reflected Cross-Site Scripting (XSS) issue that allows remote attackers to inject arbitrary JavaScript code, potentially compromising user sessions and data integrity.

Such vulnerabilities can impact compliance with standards like GDPR and HIPAA because they may lead to unauthorized access or manipulation of personal or sensitive data, violating requirements for data protection and security.

However, the provided information does not explicitly detail the direct effects on compliance with these regulations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a remote attacker to execute arbitrary JavaScript code in the context of your browser session when you access a maliciously crafted URL.

Such an attack can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the victim.

The vulnerability has a high severity score (CVSS 3.1 base score of 8.8), indicating significant potential impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-4846 is a Reflected Cross-Site Scripting (XSS) vulnerability found in MuuCmf T6 CMS version 1.9.5.20260309. It exists in the endpoint /channel/admin.Account/autoReply.html via the keyword parameter.

Specifically, user input from the keyword parameter is directly inserted into the value attribute of an input tag without any filtering or sanitization. This allows a remote attacker to inject arbitrary JavaScript code.

When a victim accesses a crafted URL containing the malicious keyword parameter, the injected script executes in the context of their browser session.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the endpoint `/channel/admin.Account/autoReply.html` for reflected cross-site scripting (XSS) via the `keyword` parameter.

A common detection method is to send a crafted HTTP request with an XSS payload in the `keyword` parameter and observe if the payload is executed or reflected unsanitized in the response.

• Use curl to send a test request with a simple XSS payload, for example: curl -i "http://<target>/channel/admin.Account/autoReply.html?keyword=<script>alert(1)</script>"
• Use a web proxy or browser developer tools to inspect the response and check if the script tag is reflected without sanitization.
• Alternatively, use automated web vulnerability scanners that support XSS detection targeting the specific URL and parameter.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include sanitizing and validating user input on the `keyword` parameter to prevent injection of malicious scripts.

Since the vendor has not responded, consider implementing a Web Application Firewall (WAF) rule to block or filter requests containing suspicious script tags or typical XSS payloads targeting the vulnerable endpoint.

Restrict access to the affected URL `/channel/admin.Account/autoReply.html` if possible, especially from untrusted networks.

Educate users to avoid clicking on suspicious links that may exploit this vulnerability.

Useful 0 Not Useful 0