CVE-2026-36460

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

4.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N                                    

Vulnerability Description

Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.

Vulnerability Details

Published Date

June 03, 2026

Last Modified

June 08, 2026

CWE ID

CWE-79

Source

NVD

External References

https://dovestones.com/download/
https://gist.github.com/pentestrox/16d92f8f8114ad3b34805c449f573cef

CVE-2026-36460

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment