CVE-2026-36460
Medium
Description
Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.
SeverityMedium
CVSS4.8
Exploit probability—
ProductADPhonebook
PublishedJun 3, 2026
First seenJun 3, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Dovestones Softwares ADPhonebook4.0.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Dovestones Softwares ADPhonebook | No range specified | 4.0.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.