Medium severity6.1NVD Advisory· Published Apr 21, 2026· Updated Apr 23, 2026
CVE-2026-31013
CVE-2026-31013
Description
Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in the victim's browser.
Affected products
2cpe:2.3:a:dovestones:ad_phonebook:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dovestones:ad_phonebook:*:*:*:*:*:*:*:*range: <4.0.1.1
- (no CPE)range: <4.0.1.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- gist.github.com/pentestrox/a35cd5df1a5a84eabada897fc4ffcc79nvdThird Party Advisory
- dovestones.com/download/nvdProduct
News mentions
0No linked articles in our index yet.