The flaw is an unsanitized user‑supplied argument in the Search field of an internal admin page that allows the injection of arbitrary script code. When an attacker succeeds, the malicious script runs in the browser context of any user that views the page, enabling theft of session cookies, defacement, or further phishing. The weakness is a classic reflected XSS (CWE‑79) with an added possibility of arbitrary code execution via reflection (CWE‑94).

The vulnerability is present in dameng100 muucmf version 1.9.5.20260309. The affected component is the /admin/Member/index.html page, specifically an unknown function that processes the Search query. No other versions or builds are listed, and the vendor did not announce a fix.

The score of 5.3 suggests moderate client‑side impact. Attackers can trigger it remotely without authentication, making the weakness widely exploitable. No EPSS value is published, and the issue is not listed in the KEV catalog. Since the vendor has not released a patch, the risk remains until a new release or a manual mitigation is applied. The attacker could compromise the confidentiality and integrity of the user session in the affected system.