CVE-2026-31013

Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in the victim's browser.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - cve@mitre.org

Published

2026-04-21

Last modified

2026-10-24

Weaknesses

CWE-79

Affected products

• Ad Phonebook (Dovestones)

References

• https://dovestones.com/download/
• https://gist.github.com/pentestrox/a35cd5df1a5a84eabada897fc4ffcc79