VulnSocial

CVE-2026-31845Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 5 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 5 mentions across 1 observed day

What's happening

  • Technical details provided in 5 signals
  • Disclosure: 4 classified signals
  • General: 1 classified signal
  • 5 total mentions across 1 day

Deep dive

Activity timeline5 mentions / 1d
01345Mentions · 2026-04-11: 5Technical Details · 2026-04-11: 504-11
Signal classification2 categories
Disclosure
480.0%
General
120.0%
Referenced assets5 URLs
Full discourse5 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-31845 Reflected XSS in Rukovoditel CRM 3.6.4 Zadarma Telephony API Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31845

    Post summary

    The post announces a reflected XSS vulnerability (CVE-2026-31845) in Rukovoditel CRM 3.6.4’s Zadarma Telephony API endpoint, linking to a detailed vulnerability report.

    0000051
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-31845 A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php).… https://www.cve.org/CVERecord?id=CVE-2026-31845 ----- Traducción: CVE-2026-31845 Exi… http://infoflow.cloud`

    Post summary

    The tweet announces a reflected XSS vulnerability (CVE-2026-31845) in Rukovoditel CRM and Zadarma API, providing technical details but no proof‑of‑concept, exploit code, patch information, or evidence of active exploitation.

    0000051
    71 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-31845 A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php).… https://www.cve.org/CVERecord?id=CVE-2026-31845

    Post summary

    The text discloses a reflected XSS flaw in Rukovoditel CRM 3.6.4 and earlier and the Zadarma API endpoint, without providing any proof‑of‑concept, exploit, or patch details.

    00000541
    57.1K followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-31845: CRITICAL] A reflected cross-site scripting (XSS) vulnerability in Rukovoditel CRM 3.6.4 allows attackers to execute arbitrary JavaScript in victims' browsers via a crafted URL in Zadarma API...#cve,CVE-2026-31845,#cybersecurity https://cvefind.com/CVE-2026-31845

    Post summary

    A reflected XSS flaw (CVE-2026-31845) was disclosed for Rukovoditel CRM 3.6.4, allowing arbitrary JavaScript via crafted URLs, with no evidence of exploits or patches mentioned.

    0000081
    620 followersView on X
  • 0day Signal@0dayPublishing
    General

    🚨 CVE-2026-31845: Rukovodit... Raw GET parameter reflection with zero filtering in CRM telephony endpoint - classic one-liner that screams legacy PHP habits. #XSS #CRM #PHP. https://zerodaysignal.com/vulnerability/CVE-2026-31845 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The post announces CVE-2026-31845, describing an XSS vulnerability due to raw GET parameter reflection in a CRM telephony endpoint, without mentioning a PoC, exploit, patch, or ongoing exploitation.

    0000094
    217 followersView on X

Explore more

Back to dashboard