Dovestones Softwares AD Self Update <4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF). The affected endpoint processes state-changing requests without requiring a CSRF token or equivalent protection. The endpoint accepts application/x-www-form-urlencoded requests, and an originally POST-based request can be converted to a GET request while still successfully updating user details. This allows an attacker to craft a malicious request that, when visited by an authenticated user, can modify user account information without their consent.
References
| Link | Resource |
|---|---|
| https://dovestones.com/download/ | Product |
| https://gist.github.com/pentestrox/64cb5febcd9b3022c1f9d3340bf586e3 | Third Party Advisory |
Configurations
History
23 Apr 2026, 16:21
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Dovestones
Dovestones ad Self Update |
|
| CPE | cpe:2.3:a:dovestones:ad_self_update:*:*:*:*:*:*:*:* | |
| References | () https://dovestones.com/download/ - Product | |
| References | () https://gist.github.com/pentestrox/64cb5febcd9b3022c1f9d3340bf586e3 - Third Party Advisory |
21 Apr 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.3 |
| CWE | CWE-352 |
21 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-21 15:16
Updated : 2026-04-23 16:21
NVD link : CVE-2026-31014
Mitre link : CVE-2026-31014
CVE.ORG link : CVE-2026-31014
JSON object : View
Products Affected
dovestones
- ad_self_update
CWE
CWE-352
Cross-Site Request Forgery (CSRF)