CVE-2026-31845

CriticalCVSS 9.3

Published: 11/04/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

40th percentile - higher than 40% of all known CVEs

Summary

Rukovoditel CRM version 3.6.4 and earlier contains a reflected cross-site scripting (XSS) vulnerability in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.

Risk Assessment

An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session theft, account takeover, or other attacks.

Recommendation

Update Rukovoditel CRM to the latest version. Additionally, apply proper output encoding and input sanitization.

Original NVD description (English source)

A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.