Skip to content
Threat Feed
Subscribe

Vendor

Rukovoditel

1 brief RSS
high advisory

Rukovoditel CRM Reflected XSS Vulnerability (CVE-2026-31845)

A reflected XSS vulnerability in Rukovoditel CRM version 3.6.4 and earlier allows unauthenticated attackers to inject malicious JavaScript by reflecting the 'zd_echo' GET parameter, leading to potential session hijacking and account takeover.

Rukovoditel CRM rukovoditel xss cve-2026-31845 web-application
2r 1t 1c