The vulnerability is a reflected cross‑site scripting flaw in list_method.php. The f query parameter is echoed directly without any sanitization or encoding. A remote attacker can therefore craft a malicious URL containing JavaScript, which will run in the victim’s browser when the page is loaded. This allows arbitrary code execution that can hijack sessions, steal credentials, or deliver malware within the application’s context.

The vulnerable code is part of XinLiangCoder’s php_api_doc application, specifically the commit 1ce5bbf1429c077d6e3f0860098099d272e3f3c2. Any instance running that commit or subsequent versions including it remains vulnerable until the issue is patched.

The CVSS score of 5.1 places the issue in the moderate range. No EPSS score is reported and it is not listed in KEV, but the exploit requires only a malicious link that a user clicks. Because the vulnerability is reflected, an attacker can use social engineering or phishing to deliver the payload, making it a realistic threat to users who visit untrusted URLs.