A remote cross‑site scripting vulnerability exists in Dameng100 MUCMF version 1.9.5.20260309, affecting the /admin/extend/list.html page. The flaw allows an attacker to craft a malicious Name parameter that is reflected unencoded in the page, enabling arbitrary JavaScript execution in the browser of any user who views the page. This can compromise confidentiality by stealing session cookies, manipulate the interface, or conduct further attacks, and it violates the integrity of the admin console. The weakness matches CWE‑79 and can potentially involve code evaluation reported as CWE‑94.

The vulnerability is present in the Dameng100 MUCMF product, specifically version 1.9.5.20260309. Operators running this admin interface are exposed, while users who only view public content are less likely to be affected unless they open the manipulated page.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, but the exploit has been publicly disclosed, implying active exploitation potential. The attack can be triggered remotely by sending a crafted request to /admin/extend/list.html; authentication is not explicitly required, suggesting that exposure may be possible to unauthenticated network users with access to the admin domain.