CVE-2026-31013 Dovestones CVE debrief

Who should care

Defenders responsible for ADPhonebook deployments should assess exposure and apply the vendor-provided patch if necessary. This includes operators, platform administrators, vulnerability management teams, and security teams. They should prioritize verifying exposure of ADPhonebook versions prior to 4.0.1.1 and applying the vendor-provided patch. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and

Why it matters

CVE-2026-31013 is a reflected XSS vulnerability in ADPhonebook that allows for the execution of arbitrary JavaScript in the victim's browser. Defenders should prioritize verifying exposure and applying the vendor-provided patch.

• Execution of arbitrary JavaScript in the victim's browser
• Potential for phishing or malicious activity

Technical summary

The vulnerability exists in the search parameter of the /ADPhonebook?Department=HR endpoint, where user-supplied input is reflected in the HTTP response without proper input validation or output encoding. This allows for the execution of arbitrary JavaScript in the victim's browser. The affected product is ADPhonebook versions prior to 4.0.1.1. Defenders should prioritize verifying exposure and applying the vendor-provided patch. The vulnerability has a CVSS score of 6.1 and is classified as MEDIUM severity. The CVE record and NVD vulnerability detail page provide additional information on the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of ADPhonebook versions prior to 4.0.1.1 and applying the vendor-provided patch.

Recommended defensive actions

• Verify ADPhonebook version and apply patch if necessary
• Implement input validation and output encoding for user-supplied input
• Monitor for suspicious activity on the /ADPhonebook endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability exists in Dovestones Softwares ADPhonebook versions prior to 4.0.1.1. Defenders should verify exposure and apply the vendor-provided patch if necessary. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.