CVE-2026-31013

A reflected cross-site scripting (XSS) vulnerability has been identified in Dovestones Software ADPhonebook versions prior to 4.0.1.1, specifically in the search parameter of the /ADPhonebook?Department=HR endpoint. The vulnerability arises from insufficient input validation and output encoding, permitting attackers to inject and execute arbitrary JavaScript code within a victim's browser session. This affects all versions of the application below the patched release 4.0.1.1. The vulnerability carries a CVSS 3.1 score of 6.1 (Medium severity) with a network-based attack vector requiring no special privileges but necessitating user interaction. The attack has low complexity and could result in limited confidentiality and integrity impacts, though availability is not compromised. The EPSS score of 0.00036 indicates this vulnerability is among the lower-probability candidates for exploitation relative to the broader CVE landscape. Currently, there is no evidence of active exploitation, public exploit code availability, or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability remains inactive on industry hot lists, and community attention appears minimal. Organizations running ADPhonebook should prioritize upgrading to version 4.0.1.1 or later as a standard patch management practice, though immediate emergency response measures are not warranted based on current threat indicators.