Medium severity4.8NVD Advisory· Published Jun 3, 2026· Updated Jun 8, 2026

CVE-2026-36460

Description

Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dovestones/AD Phonebookllm-fuzzy
Range: <4.0.1.1

Patches

Vulnerability mechanics

References

dovestones.com/download/nvd
gist.github.com/pentestrox/16d92f8f8114ad3b34805c449f573cefnvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000