A reflected XSS vulnerability exists in the /admin/config/list.html page of dameng100 muucmf. By manipulating the Name argument in a URL, an attacker can inject JavaScript that is executed in the browser of any user who views the page. The description does not explicitly state the results of such script execution, but it is inferred that typical consequences of reflected XSS include session hijacking, defacement of web content, or other client‑side attacks.

The affected product is dameng100 muucmf version 1.9.5.20260309. The vulnerability is located in an unknown function within the administrative configuration interface, meaning that only users who can access the /admin/config/list.html page can exploit it. The vendor was notified but did not issue a public resolution.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, yet public exploits have been released, indicating real world exploitation potential. The attack vector is remote and relies on a normal HTTP request to a publicly accessible page; an attacker can supply a crafted Name value in the query string to trigger the payload. This scenario is inferred from the nature of reflected XSS and the fact that the exploit can be initiated remotely.