The vulnerability is a cross‑site scripting flaw found in dameng100 muucmf 1.9.5.20260309. An unknown function within the file channel/admin.Account/autoReply.html can be manipulated through the keyword argument, allowing an attacker to inject arbitrary client‑side script. The injected script runs in the victim’s browser, potentially leading to theft of session cookies, defacement, or further attacks. This flaw is an instance of CWE‑79 (XSS) and is considered a moderate‑severity vulnerability.

Dameng100 muucmf software version 1.9.5.20260309 is vulnerable. The affected component is the autoReply.html page located in channel/admin.Account. No other versions or products were listed; therefore only the specified version is considered at risk.

The CVSS score for this issue is 5.3, indicating a moderate impact. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting it hasn't been widely exploited. The flaw can be exploited remotely via HTTP requests to the problematic endpoint, and the exploit has already been made public. Because the vendor did not respond to the initial disclosure, the window for a patch is uncertain, raising the risk for organizations still running the affected build.