The vulnerability in the Evoluted PHP Directory Listing Script allows an attacker to inject arbitrary JavaScript by providing a crafted value for the dir parameter. The unconstrained value is reflected unencoded within the HTML title element and within anchor href attributes in the breadcrumb navigation. When a victim’s browser renders the page, the injected script executes in the victim’s context, enabling session hijacking, credential theft, or delivery of malicious payloads.

The vulnerability affects installations of the Evoluted PHP Directory Listing Script through version 4.0.5. Any instance deployed without a later patched release is susceptible.

With a CVSS score of 5.1 the risk is moderate under the assumption that the affected web application is exposed to unauthenticated users who can manipulate the dir parameter. The absence of an existing EPSS score does not diminish the attack vector, which is a typical web‑browser based reflected XSS that requires only a crafted URL. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time.