What is the CVSS score of CVE-2026-38935?

CVE-2026-38935 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

diskover-community CVE-2026-38935

EUVD-2026-25890 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-27 cve@mitre.org

PHP XSS

6.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-reachable PHP app, no auth needed, but UI:R required; XSS scope change yields S:C with partial C/I, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:09 vuln.today

CVSS changed

Apr 27, 2026 - 18:22 NVD

6.1 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 17:22 euvd

EUVD-2026-25890

CVE Published

Apr 27, 2026 - 17:16 nvd

MEDIUM 6.1

DescriptionCVE.org

A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the doctype parameter

AnalysisAI

Reflected XSS in diskover-community's public/view.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in the doctype parameter of a crafted URL. Affected versions are 2.3.5 and below of this PHP-based open-source file indexing application. A proof-of-concept exploit is confirmed per SSVC assessment, though EPSS sits at the 1st percentile and active exploitation has not been confirmed by CISA KEV, suggesting opportunistic rather than widespread targeting.

Technical ContextAI

diskover-community is a PHP-based open-source file indexer and search platform. The vulnerability resides in public/view.php, where the doctype GET parameter is reflected into the HTML response without adequate output encoding or sanitization - the root cause class per CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting). Because the reflection is immediate (not stored), the payload must be delivered via a crafted URL. The CVSS scope metric S:C indicates the injected script executes in the victim's browser security context rather than on the server, enabling theft of session tokens, credential harvesting via fake UI overlays, or redirection to attacker-controlled resources.

RemediationAI

No vendor-released patch version has been identified at time of analysis - the available references point to the vendor's website (http://diskoverdata.com, http://diskover-community.com) and a researcher writeup at https://github.com/VadlaReddySai/diskoverdata-cve-writeups/blob/main/CVE-2026-38935, none of which confirm an exact patched release. Administrators should monitor the diskover-community GitHub repository and vendor site for a patched release beyond 2.3.5 and apply it immediately when available. As a compensating control, restrict public/view.php to authenticated sessions only if the application framework supports it - this would eliminate unauthenticated exploitation since a session requirement shifts the CVSS PR metric from N to L. Additionally, deploying a web application firewall rule to sanitize or block requests containing HTML/script characters in the doctype parameter is a viable short-term mitigation, though WAF bypasses for XSS are common and this should not substitute for a code-level fix. If the diskover instance does not require public Internet exposure, network-level access restrictions are the most effective compensating control with no application-side trade-offs.