CVE-2026-25557

MediumCVSS 5.4/10Last modified Jul 23, 2026

Description

Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php where the dir parameter value is reflected without HTML encoding inside the HTML title element and inside anchor href attributes in the breadcrumb navigation. Attackers can inject arbitrary JavaScript via crafted dir parameter values by breaking out of the title context or injecting event handlers into breadcrumb anchor attributes to execute malicious scripts in a victim's browser.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-255584.8QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administratorCVE-2026-255598.8OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint that allows authenticated attackers to peCVE-2026-25566.3A security vulnerability has been detected in cskefu up to 8.0.1. This issue affects some unknown processing of the file com/cskefu/cc/contrCVE-2026-255609.8WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporCVE-2026-255617.5WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided iCVE-2026-255624.3WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be retuCVE-2026-255637.5WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implCVE-2026-255647.5WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implCVE-2026-255656.5WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rathCVE-2026-255665.4WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlaneCVE-2026-255674.3WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an auCVE-2026-255684.3WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not s
CVE-2026-25557: Medium severity, CVSS 5.4 | Vulnix