CVE-2026-31845 — Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint

CVE-2026-31845

Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint PUBLISHED

Description (CNA)

A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.

Affected (CNA)

Vendor / product	Versions
Rukovoditel / Rukovoditel CRM	affected 3.6.4; unaffected 3.7

CWE

CWE-79

References

https://forum.rukovoditel.net/viewtopic.php?p=22499#p22499

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.