CVE-2026-96810 describes a cross-site scripting vulnerability in huanzi-qch base-admin up to commit 52816b760cd53244989fd664bbb2b3d4edbfdbf1. The flaw is in the Save function of the Add User Handler component, located in CommonController.java. Manipulation of the Username parameter can lead to XSS attacks. The vulnerability can be exploited remotely. No version details are available due to the product's continuous delivery model. The vendor did not provide any response or patch information. Public exploit code exists but no known exploitation in the wild has been reported.

The vulnerability allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts via the Username parameter in the Add User Handler. This can lead to limited impact such as user interface manipulation or session hijacking in affected deployments. The CVSS score of 3.5 reflects low severity with no confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patches are publicly available, users should monitor official channels for updates. In the meantime, applying input validation or sanitization on the Username parameter may mitigate exploitation risk.