The vulnerability in Dovestones Softwares ADPhonebook before version 4.0.1.1 is a Cross Site Scripting (XSS) issue located in the /Admin/Save API endpoint. Authenticated administrators can store malicious JavaScript payloads in various configuration sections because the application lacks proper input validation and output encoding. This can lead to script execution in the context of the application, potentially impacting administrative users. No CVSS score or vendor remediation details are currently available.

An authenticated admin user can inject malicious scripts into the application configuration, which may execute in the context of other administrative sessions. This could lead to session hijacking, unauthorized actions, or other impacts typical of stored XSS vulnerabilities. However, exploitation requires admin authentication, limiting the attack surface. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity. Avoid using vulnerable versions in production environments where possible.