Executive brief
Evoluted PHP Directory Listing Script is a tool used to display and manage files on a web server through a browser. A security flaw allows attackers to inject malicious scripts into the application by tricking a user into clicking a specially crafted link. If successful, an attacker could execute unauthorized actions in the user's browser, potentially leading to data theft or account compromise.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Evoluted PHP Directory Listing Script through version 4.0.5. The 'dir' parameter in index.php is reflected into the page's HTML title element and breadcrumb navigation anchor tags without proper HTML encoding. An unauthenticated remote attacker can exploit this by persuading a victim to visit a URL containing a malicious payload. This allows the attacker to break out of the title context or inject event handlers into breadcrumb attributes, executing arbitrary JavaScript in the context of the victim's browser session.
Affected products
- Evoluted PHP Directory Listing Script through 4.0.5
Timeline
- 2026-06-05: disclosed: Researcher disclosure on GitHub Gist
- 2026-06-09: advisory: NVD and VulnCheck advisory published