The PHP Telephone Directory is vulnerable to Reflected XSS and Stored XSS. In the public search, an attacker can inject malicious code into the 'key' parameter. In the administration web interface, an attacker can inject malicious code into the 'key' parameter. In the administration web directory interface, an attacker can inject malicious code into the 'pointcode', 'contacttitle', 'firstname', 'lastname', 'middlename', 'employeeID', 'otherID', 'phonenumber1', 'internalphonenumber', 'phonenumber2', 'phonenumber3', 'fax', 'mobilecell', 'email', 'alternateemail', 'chat', 'website', 'socialmedia1', 'socialmedia2', 'socialmedia3', 'contactposition', 'company', 'qualifications', 'buildingroom', 'address', 'city', 'suite', 'state', 'zip', 'country', 'notes', 'contacttype', 'contactstatus', 'contactgroup', 'contactgroup2', 'contactgroup3', 'contactgroup4', and 'contactgroup5' parameters.