CVE-2026-36460

MediumCVSS 4.8

Published: 03/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

Dovestones Software ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.

Risk Assessment

An admin can inject persistent XSS that may execute in other users' browsers, leading to session theft or data leakage.

Recommendation

Update ADPhonebook to version 4.0.1.1 or later.

Other vulnerabilities in ADPhonebook

CVE-2026-31013Medium
Dovestones Software ADPhonebook before 4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in the victim's browser.

Original NVD description (English source)

Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS