CVE-2026-25557

MEDIUM 5.4

Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php where the dir parameter value is reflected without HTML encoding inside the HTML title element and inside anchor href attributes in the breadcrumb navigation. Attackers can inject arbitrary JavaScript via crafted dir parameter values by breaking out of the title context or injecting event handlers into breadcrumb anchor attributes to execute malicious scripts in a victim's browser.

CWE	CWE-79
Vendor	evoluted
Product	php directory listing script
Published	Jun 9, 2026

Stay Ahead of the Next One

Get instant alerts for evoluted php directory listing script

Be the first to know when new medium vulnerabilities affecting evoluted php directory listing script are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Evoluted / PHP Directory Listing Script

0 ≤ 4.0.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gist.github.com: https://gist.github.com/cyberinforepo/d62cf53ef42ff703ca67792d49bf6780 evoluted.net: https://www.evoluted.net/blog/development/php-directory-listing-script vulncheck.com: https://www.vulncheck.com/advisories/evoluted-php-directory-listing-script-reflected-xss-via-dir-parameter

Credits

philopentest VulnCheck