CVE-2026-36460

Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.

An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to data theft or session hijacking. This poses a significant security risk to the application and user data.

It is recommended to update the software to version 4.0.1.1 or later to mitigate this vulnerability. Additionally, proper input validation and output encoding mechanisms should be implemented in the application.