CVE-2026-31845CWE-79cross-site-scripting

CVE-2026-31845

Critical · published April 11, 2026

CVSS v3.1

9.3

EPSS

Percentile

40.3

In the wild

Unconfirmed

What it is

A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.

The record

Technical detail

CVSS v3.1: 9.3 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00478 · 40.3th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2026-04-11T23:16Z

References (1)

https://forum.rukovoditel.net/viewtopic.php?p=22499#p22499 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

EPSS history

Timeline

11 APR 18:26Z
A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint…
cvelistv5