EUVD-2026-21682

A pre-authenticated reflected cross-site scripting XSS vulnerability exists in Rukovoditel CRM version 3.6.4 in the Zadarma telephony API endpoint /api/tel/zadarma.php. The application directly reflects user-supplied input from the 'zdecho' GET parameter into the HTTP response without proper...

PT-2026-32121

Name of the Vulnerable Software and Affected Versions Rukovoditel CRM versions prior to 3.6.5 Description A reflected cross-site scripting XSS issue exists in the Zadarma telephony API endpoint '/api/tel/zadarma.php'. The application reflects user-supplied input from the zd echo GET parameter int...