EUVD-2026-34140
GHSA-5c2q-xgpr-q68v
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.
AnalysisAI
Stored Cross-Site Scripting in Dovestones Softwares ADPhonebook before v4.0.1.1 permits authenticated admin users to inject persistent JavaScript payloads via the /Admin/Save API endpoint. Because multiple configuration sections lack input validation and output encoding, injected scripts survive across sessions and execute in any victim's browser when the affected configuration pages are loaded, with CVSS scope change (S:C) confirming cross-user impact beyond the planting admin. No public exploitation identified at time of analysis; EPSS is 0.02% (5th percentile), though a publicly available proof-of-concept gist exists at the referenced GitHub URL.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-supplied data before rendering it as HTML or JavaScript in a browser context. In ADPhonebook, the /Admin/Save API endpoint accepts configuration payloads and persists them to storage without server-side input validation or context-aware output encoding. When those configuration values are later retrieved and rendered in the admin UI, the raw payload is executed by the browser as script. The CVSS vector S:C (Scope Changed) is technically significant: it confirms the injected payload can affect security principals other than the admin who stored it - meaning a single malicious configuration write can compromise multiple user sessions. CPE data returned as n/a by NVD, so exact platform and OS context are not confirmed; the product is a Windows-based Active Directory phonebook tool based on the vendor download page context.
RemediationAI
Upgrade ADPhonebook to v4.0.1.1 or later - this is the fix version indicated by the CVE description and the vendor download page at https://dovestones.com/download/. Note that the patched version is inferred from the vulnerability description and has not been independently confirmed via a dedicated vendor security advisory. If immediate upgrade is not feasible, restrict access to the ADPhonebook admin panel to a dedicated management VLAN or trusted IP ranges using firewall or reverse-proxy ACLs; this prevents unauthorized parties from reaching the /Admin/Save API entirely. Additionally, enforce the principle of least privilege by minimizing the number of accounts with admin access to the application, and review existing configuration sections for anomalous or unexpected script content as an indicator of prior exploitation. Monitor admin session activity for unusual configuration changes as a compensating detective control.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today