CVE-2026-36460

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.

Published 2026-06-03. Last modified 2026-07-22.