CVE-2026-32844 Details

A reflected cross-site scripting vulnerability has been identified in XinLiangCoder php_api_doc, specifically in list_method.php, prior to commit 1ce5bbf. This vulnerability allows remote attackers to execute arbitrary JavaScript in the context of the victim's browser. Exploitation involves injecting malicious code through the 'f' parameter of a GET request. The unsanitized input is directly output to the page without adequate neutralization, which could lead to session hijacking, credential theft, or malware distribution within the application context.