CVE-2026-31845 | Rukovoditel CRM up to 3.6/3.6.4 API Endpoint /api/tel/zadarma.php zd_echo cross site scripting

A vulnerability, which was classified as problematic, has been found in Rukovoditel CRM up to 3.6/3.6.4. This issue affects some unknown processing of the file /api/tel/zadarma.php of the component API Endpoint. The manipulation of the argument zd_echo leads to cross site scripting.

This vulnerability is uniquely identified as CVE-2026-31845. The attack is possible to be carried out remotely. No exploit exists.

It is advisable to upgrade the affected component.