CVE-2026-31013

MEDIO 6.1CVE-2026-31013 · Published 21/04/2026 · updated 24/10/2026

In breve

CVE-2026-31013 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda ad phonebook (dovestones).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.19%, superiore al 9.2% delle vulnerabilità.
Correzione: aggiornare a 4.0.1.1 o successiva.

Package	Affected versions	Patched versions
ad phonebook dovestones	`< 4.0.1.1`	`4.0.1.1`

Description

Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in the victim's browser.

References

dovestones.com/download · Product
gist.github.com/pentestrox/a35cd5df1a5a84eabada897fc4ffcc79 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free