Dovestones Softwares ADPhonebook contains a stored cross‑site scripting flaw that permits authenticated administrators to save configuration data through the /Admin/Save API without adequate input validation or output encoding, enabling malicious JavaScript to be persisted and later rendered in an administrator’s browser. The vulnerability is a classic example of a CWE‑79 type injection.

All Dovestones Softwares ADPhonebook installations prior to version 4.0.1.1 are affected; no other vendors or products were identified.

Exploitation demands that an attacker first obtain administrative authentication to access the /Admin/Save endpoint. Once authenticated, the flaw can be exercised casually due to the lack of additional protection. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, while the CVSS score of 4.8 reflects moderate severity. Because the vulnerability is not listed in the CISA KEV catalog, no publicly reported exploits are currently known. The potential impact, inferred from the presence of stored XSS in a privileged context, could allow an attacker to run arbitrary code, steal session credentials, or modify the admin interface.