The vulnerability CVE-2026-31013 affects Dovestones Softwares ADPhonebook prior to version 4.0.1.1. It is a reflected cross-site scripting (XSS) issue located in the search parameter of the /ADPhonebook?Department=HR endpoint. The flaw occurs because user-supplied input is directly reflected in HTTP responses without adequate input validation or output encoding. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser when they visit a crafted URL. There is no CVSS score or vendor advisory indicating patch availability or remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of a victim's browser. This may lead to theft of session cookies, defacement, or other client-side attacks. However, no known exploits are reported in the wild, and the impact is limited to users who visit maliciously crafted URLs targeting the vulnerable endpoint.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links targeting the /ADPhonebook?Department=HR endpoint. Implementing web application firewall (WAF) rules to detect and block reflected XSS attempts may provide temporary protection. Developers should apply proper input validation and output encoding on the affected parameter once a fix is released.