CVE-2026-96810 in base-admin
Summary
by MITRE • 09/24/2026
A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\src\main\java\cn\huanzi\qch\baseadmin\common\controller\CommonController.java of the component Add User Handler. The manipulation of the argument Username leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The identified vulnerability resides within the huanzi-qch base-admin application, specifically affecting versions up to commit 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This security flaw is located in the Save function of the CommonController.java file, which serves as a critical component for user management operations within the application architecture. The vulnerability stems from improper input validation and sanitization mechanisms when handling the Username argument during the Add User Handler process. Because the system fails to adequately neutralize special characters that have meaning in HTML or JavaScript contexts before including them in web pages, it creates an environment ripe for cross-site scripting attacks. This type of flaw is classically categorized under CWE-79, which defines Improper Neutralization of Input During Web Page Generation as a standard weakness leading to XSS vulnerabilities.
The operational impact of this vulnerability allows for remote exploitation by any authenticated user who has the privilege to add new users or manipulate existing user data through the administrative interface. An attacker can craft malicious payloads containing executable JavaScript code and inject them into the Username field during account creation or modification. When an administrator or another authorized user views the affected page, such as a user list or profile management screen, the browser executes the injected script in the context of the application's domain. This execution environment grants the malicious script access to sensitive cookies, session tokens, and other credentials stored by the browser for that specific site. Consequently, an attacker can hijack active sessions, impersonate legitimate users, perform actions on behalf of victims, or deface the web interface, thereby compromising the confidentiality, integrity, and availability of the administrative system.
From a tactical perspective, this vulnerability aligns with ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution, which describes how attackers use scripts to execute malicious commands within a victim's browser session. The persistence of this risk is exacerbated by the continuous delivery model employed by the product developers, characterized by rolling releases without distinct version numbers or formal release notes. This development practice obscures the specific build versions that contain the fix, making it difficult for administrators to determine whether their deployment has been patched. Furthermore, the lack of vendor response to early disclosure attempts means there is no official patch available through standard update channels, leaving organizations relying on this software with limited remediation options other than manual code modification or temporary workarounds such as strict input filtering at a reverse proxy level if feasible within their infrastructure constraints.