CVE-2026-31013

23th percentile - higher than 23% of all known CVEs

Dovestones Software ADPhonebook before 4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in the victim's browser.

An attacker can trick a logged-in user into clicking a crafted link, enabling session theft or actions performed in the victim's context. This may lead to account takeover or leakage of phonebook data.

Update ADPhonebook to version 4.0.1.1 or later. Until then, implement input validation and output encoding, and consider a WAF to block XSS attempts.