The vulnerability allows an attacker to inject and execute arbitrary JavaScript inside a victim's browser by manipulating the Department query parameter on the /ADPhonebook?Department=HR endpoint. User‑supplied data is reflected in the HTTP response without any input validation or output encoding, giving the attacker full control over the page context. This can lead to session hijacking, cookie theft, defacement, or other client‑side attacks.

The affected product is Dovestones Softwares’ ADPhonebook application, specifically any release prior to version 4.0.1.1. No other vendors are listed as affected.

The CVSS score of 6.1 classifies this as a moderate‑severity flaw, but reflected XSS is typically trivial to exploit via crafted URLs or emails and requires no authentication. Because the EPSS score is not available, the exploitation probability remains unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers can succeed by embedding malicious scripts in a link that the victim clicks, exploiting the lack of input sanitisation and resulting in arbitrary code execution in the victim’s browser context.