Dovestones CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Dovestones CVE published 2026-04-21

CVE-2026-31013

CVE-2026-31013 is a reflected cross-site scripting (XSS) vulnerability in Dovestones Softwares ADPhonebook versions prior to 4.0.1.1. The vulnerability exists in the search parameter of the /ADPhonebook?Department=HR endpoint, where user-supplied input is reflected in the HTTP response without proper input validation or output encoding. This allows for the execution of arbitrary JavaScript in the victim's browser.