The vulnerability is a reflected cross‑site scripting flaw located in index.php of MiniGal Nano version 0.3.5 and earlier releases. An attacker can inject arbitrary HTML or JavaScript through the dir parameter, which the application incorporates into an error message without proper output encoding. When a victim visits the crafted URL, the malicious payload is reflected back in the response, allowing the attacker to execute code in the victim’s browser under the application’s domain. This can result in cookie theft, phishing, content tampering, or other client‑side attacks.

MiniGal Nano, version 0.3.5 and all earlier releases; vendor MiniGal, provider of the web application.

The CVSS score of 5.1 indicates a moderate impact, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a standard HTTP request to the vulnerable application, where the attacker merely supplies a crafted dir parameter in the URL. An attacker needs only to send a link to the victim, and the vulnerability is exploitable without additional privileges or pre‑existing conditions.