CVE-2026-31013

MEDIUM · 6.1 CVSS Gepubliceerd: 21-04-2026 CWE-79

Beschrijving

Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in the victim's browser.

Vendors

Dovestones

Affected products

Ad Phonebook

References

dovestones.com
gist.github.com