What is the CVSS score of CVE-2026-36460?

CVE-2026-36460 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ADPhonebook CVE-2026-36460

EUVD-2026-34140 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-03 mitre

GHSA-5c2q-xgpr-q68v

XSS N A

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:29 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

4.8 (MEDIUM)

CVE Published

Jun 03, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.

AnalysisAI

Stored Cross-Site Scripting in Dovestones Softwares ADPhonebook before v4.0.1.1 permits authenticated admin users to inject persistent JavaScript payloads via the /Admin/Save API endpoint. Because multiple configuration sections lack input validation and output encoding, injected scripts survive across sessions and execute in any victim's browser when the affected configuration pages are loaded, with CVSS scope change (S:C) confirming cross-user impact beyond the planting admin. No public exploitation identified at time of analysis; EPSS is 0.02% (5th percentile), though a publicly available proof-of-concept gist exists at the referenced GitHub URL.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-supplied data before rendering it as HTML or JavaScript in a browser context. In ADPhonebook, the /Admin/Save API endpoint accepts configuration payloads and persists them to storage without server-side input validation or context-aware output encoding. When those configuration values are later retrieved and rendered in the admin UI, the raw payload is executed by the browser as script. The CVSS vector S:C (Scope Changed) is technically significant: it confirms the injected payload can affect security principals other than the admin who stored it - meaning a single malicious configuration write can compromise multiple user sessions. CPE data returned as n/a by NVD, so exact platform and OS context are not confirmed; the product is a Windows-based Active Directory phonebook tool based on the vendor download page context.

RemediationAI

Upgrade ADPhonebook to v4.0.1.1 or later - this is the fix version indicated by the CVE description and the vendor download page at https://dovestones.com/download/. Note that the patched version is inferred from the vulnerability description and has not been independently confirmed via a dedicated vendor security advisory. If immediate upgrade is not feasible, restrict access to the ADPhonebook admin panel to a dedicated management VLAN or trusted IP ranges using firewall or reverse-proxy ACLs; this prevents unauthorized parties from reaching the /Admin/Save API entirely. Additionally, enforce the principle of least privilege by minimizing the number of accounts with admin access to the application, and review existing configuration sections for anomalous or unexpected script content as an indicator of prior exploitation. Monitor admin session activity for unusual configuration changes as a compensating detective control.