Which versions of PHP are affected by CVE-2026-32844?

Organizations using XinLiangCoder php_api_doc through commit 1ce5bbf should be aware of moderate risk from CVE-2026-32844, a cross-site scripting vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2026-32844?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-32844

Q: What is the CVSS score of CVE-2026-32844?

CVE-2026-32844 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13752 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 VulnCheck

XSS PHP

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 14, 2026 - 01:22 NVD

6.1 (MEDIUM) 5.1 (MEDIUM)

EUVD ID Assigned

Mar 20, 2026 - 17:45 euvd

EUVD-2026-13752

Analysis Generated

Mar 20, 2026 - 17:45 vuln.today

CVE Published

Mar 20, 2026 - 17:26 nvd

MEDIUM 6.1

DescriptionCVE.org

XinLiangCoder php_api_doc through commit 1ce5bbf contains a reflected cross-site scripting vulnerability in list_method.php that allows remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious code through the f parameter. Attackers can craft a malicious URL with unsanitized input in the GET request parameter that is output directly to the page without proper neutralization, enabling session hijacking, credential theft, or malware distribution within the application context.

AnalysisAI

A reflected cross-site scripting (XSS) vulnerability exists in XinLiangCoder's php_api_doc application through commit 1ce5bbf, specifically in the list_method.php file where the 'f' GET parameter is output directly to the page without sanitization. Remote attackers can inject arbitrary JavaScript code by crafting malicious URLs, enabling session hijacking, credential theft, and malware distribution within the application context. No CVSS score, EPSS data, or KEV status are currently available, but the vulnerability is confirmed with a proof-of-concept reference available via VulnCheck advisory.

Technical ContextAI

The vulnerability is a classic reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based API documentation tool. The affected product is XinLiangCoder php_api_doc (CPE: cpe:2.3:a:xinliangcoder:php_api_doc:*:*:*:*:*:*:*:*), which appears to be a documentation generation or API management utility written in PHP. The root cause is the failure to sanitize or escape user-supplied input from the 'f' parameter in GET requests before rendering it as HTML output. This allows an attacker to inject malicious JavaScript that executes in the context of a victim's browser session, bypassing same-origin protections through the reflective nature of the attack. The vulnerability demonstrates a fundamental lack of output encoding mechanisms such as HTML entity encoding or Content Security Policy (CSP) enforcement.

RemediationAI

Immediately upgrade XinLiangCoder php_api_doc to a patched version if available from the vendor; check the GitHub repository for commits after 1ce5bbf that address the XSS vulnerability in list_method.php. If a patched version is unavailable, implement the following workarounds: (1) disable or restrict direct access to list_method.php through web server configuration or firewall rules; (2) enforce strict input validation and output encoding by adding HTML entity encoding (e.g., htmlspecialchars() in PHP with ENT_QUOTES flag) to all instances where the 'f' parameter is output; (3) implement a Content Security Policy (CSP) header to restrict script execution; (4) place the application behind a Web Application Firewall (WAF) configured to detect and block XSS payloads. Monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/xinliangcoder-php-api-doc-reflected-xss-via-list-method-php) and the GitHub repository for official security patches.