EUVD-2026-25891Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS needing no privileges but mandatory victim interaction; scope changes to browser context with partial confidentiality and integrity impact, no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter
AnalysisAI
Reflected XSS in diskover-community 2.3.5 and earlier allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session by tricking an authenticated user into clicking a crafted URL with a malicious namecontains parameter targeting public/selectindices.php. A public proof-of-concept writeup exists on GitHub, though EPSS rates exploitation probability at 0.01% (1st percentile) and CISA has not added this to the Known Exploited Vulnerabilities catalog. SSVC confirms the exploit exists but flags the attack as non-automatable due to required user interaction, limiting realistic risk to targeted phishing scenarios.
Technical ContextAI
diskover-community is an open-source PHP-based file search and data management platform. The vulnerability resides in public/selectindices.php, which accepts user-supplied input via the namecontains parameter and reflects it into the HTML response without adequate output encoding or sanitization. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause - the PHP application embeds the raw parameter value into the rendered DOM without escaping HTML metacharacters such as angle brackets, quotes, or script tags. The CVSS scope-changed flag (S:C) indicates the injected script executes in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or UI redress attacks originating from the application's trusted origin. No CPE string was provided in the input data; the affected product boundary is established by NVD and the EUVD entry EUVD-2026-25891.
RemediationAI
No vendor-released patch has been identified at time of analysis - the provided references include vendor website URLs but no specific advisory page or changelog entry with a confirmed fixed version. Organizations should monitor http://diskoverdata.com and the upstream GitHub repository for a patched release beyond version 2.3.5 and upgrade promptly when available. As an immediate compensating control, deploy a Web Application Firewall rule to block or HTML-encode requests to /public/selectindices.php where the namecontains parameter contains HTML metacharacters (<, >, ', ", or the string 'script'); note this may introduce false positives for legitimate search queries containing special characters. Where feasible, restrict access to the selectindices.php endpoint to trusted internal IP ranges or VPN-authenticated sessions to reduce the phishing attack surface without affecting core search functionality. If the index-selection feature is not actively used, consider removing or serving public/selectindices.php from a location inaccessible to unauthenticated users as a temporary measure. Ensuring session cookies are flagged HttpOnly will limit the impact of any successful XSS by preventing document.cookie exfiltration, though UI-redress and form-hijacking attacks would remain viable.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today