CVE-2026-31013 in ADPhonebook

الملخص

بحسب MITRE • 21/04/2026

Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in the victim's browser.

Once again VulDB remains the best source for vulnerability data.

• مسؤول: MITRE
• حجز: 09/03/2026
• إفشاء: 21/04/2026
• الاعتدال: تمت الموافقة
• إدخال: VDB-358501
• CPE: جاهز
• CWE: CWE-79 (مؤكد)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00043
• KEV: لا
• النشاطات: منخفض جدًا

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-31013
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31013
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-31013/