XinLiangCoder php_api_doc contains a reflected cross‑site scripting flaw in list_method.php. The vulnerability arises when the f parameter of a GET request is reflected back to the browser without sanitization, allowing an attacker to inject arbitrary JavaScript. When a victim visits the crafted URL, the injected code runs in the context of the application, enabling attacks such as session hijacking, credential theft, or malware delivery.

The flaw affects all releases of XinLiangCoder php_api_doc that incorporate commit 1ce5bbf, which introduced the vulnerability. Any deployment built before this commit is vulnerable; versions after that commit are presumed safe if the change was corrected, though no specific version numbers are listed.

The vulnerability has a CVSS score of 5.1, indicating moderate severity. The EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to craft a malicious URL containing unsanitized input in the f parameter and for a victim to click the link, at which point the payload is executed.