CVE-2025-39567 describes a reflected cross-site scripting vulnerability in Shamalli Web Directory Free (<= 1.7.8) caused by improper input neutralization during web page generation. This flaw allows an attacker to craft malicious input that is reflected in the web page output without proper sanitization, enabling script execution in the victim's browser. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, there are no known active exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for updates and apply any future patches promptly. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts and educate users about the risks of interacting with suspicious links.