CVE-2026-25557

Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php where the dir parameter value is reflected without HTML encoding inside the HTML title element and inside anchor href attributes in the breadcrumb navigation. Attackers can inject arbitrary JavaScript via crafted dir parameter values by breaking out of the title context or injecting event handlers into breadcrumb anchor attributes to execute malicious scripts in a victim's browser.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/cyberinforepo/d62cf53ef42ff703ca67792d49bf6780
https://www.evoluted.net/blog/development/php-directory-listing-script
https://www.vulncheck.com/advisories/evoluted-php-directory-listing-script-reflected-xss-via-dir-parameter

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) El script de listado de directorios PHP Evoluted hasta la versión 4.0.5 contiene una vulnerabilidad de cross-site scripting reflejado en index.php donde el valor del parámetro dir se refleja sin codificación HTML dentro del elemento HTML title y dentro de los atributos href de los anclajes en la navegación de migas de pan. Los atacantes pueden inyectar JavaScript arbitrario a través de valores de parámetro dir manipulados al escapar del contexto del título o inyectar manejadores de eventos en los atributos de anclaje de las migas de pan para ejecutar scripts maliciosos en el navegador de una víctima.

09 Jun 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 21:17

Updated : 2026-07-23 09:10

NVD link : CVE-2026-25557

Mitre link : CVE-2026-25557

CVE.ORG link : CVE-2026-25557

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-25557", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25557", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T13:44:08.041072Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Evoluted", "product": "PHP Directory Listing Script", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.0.5"}], "defaultStatus": "affected"}]}], "published": "2026-06-09T21:17:04.173", "references": [{"url": "https://gist.github.com/cyberinforepo/d62cf53ef42ff703ca67792d49bf6780", "source": "disclosure@vulncheck.com"}, {"url": "https://www.evoluted.net/blog/development/php-directory-listing-script", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/evoluted-php-directory-listing-script-reflected-xss-via-dir-parameter", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php where the dir parameter value is reflected without HTML encoding inside the HTML title element and inside anchor href attributes in the breadcrumb navigation. Attackers can inject arbitrary JavaScript via crafted dir parameter values by breaking out of the title context or injecting event handlers into breadcrumb anchor attributes to execute malicious scripts in a victim's browser."}, {"lang": "es", "value": "El script de listado de directorios PHP Evoluted hasta la versi\u00f3n 4.0.5 contiene una vulnerabilidad de cross-site scripting reflejado en index.php donde el valor del par\u00e1metro dir se refleja sin codificaci\u00f3n HTML dentro del elemento HTML title y dentro de los atributos href de los anclajes en la navegaci\u00f3n de migas de pan. Los atacantes pueden inyectar JavaScript arbitrario a trav\u00e9s de valores de par\u00e1metro dir manipulados al escapar del contexto del t\u00edtulo o inyectar manejadores de eventos en los atributos de anclaje de las migas de pan para ejecutar scripts maliciosos en el navegador de una v\u00edctima."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "disclosure@vulncheck.com"}