CVE-2026-36460 describes a Cross Site Scripting vulnerability in Dovestones Softwares ADPhonebook before version 4.0.1.1. The vulnerability exists in the /Admin/Save API, which permits authenticated administrators to store malicious JavaScript in configuration sections due to insufficient input validation and output encoding. This flaw could allow an attacker with admin privileges to execute arbitrary scripts in the context of the application, potentially impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An authenticated administrator can inject malicious JavaScript code into configuration sections via the /Admin/Save API. Successful exploitation could lead to script execution in the context of the application, potentially allowing data manipulation or disclosure limited to the scope of the affected system. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires admin privileges and user interaction, reducing the overall risk.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict administrative access to trusted users only and monitor for suspicious activity related to configuration changes. Avoid executing untrusted scripts or content in the administrative interface.