CVE-2014-9101

🗓️ 26 Nov 2014 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 52 Views🌐 WEB

Multiple CSRF vulnerabilities in Oxwall 1.7.0 and SkaDate Lite 2.0 allow remote attackers to hijack authentication of administrators for XSS attacks

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2014-9101	26 Nov 201415:00	–	cvelist
EUVD	EUVD-2014-8927	7 Oct 202500:30	–	euvd
NVD	CVE-2014-9101	26 Nov 201415:59	–	nvd
Prion	Cross site request forgery (csrf)	26 Nov 201415:59	–	prion
RedhatCVE	CVE-2014-9101	22 May 202513:44	–	redhatcve
Zero Science Lab	Oxwall 1.7.0 Multiple CSRF And HTML Injection Vulnerabilities	28 Jul 201400:00	–	zeroscience
Zero Science Lab	SkaDate Lite 2.0 Multiple XSRF And Persistent XSS Vulnerabilities	30 Jul 201400:00	–	zeroscience

NVD

Node

skalfa skadate_liteMatch2.0

Node

oxwall oxwallMatch1.7.0

Source	Link
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5197.php
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5195.php
osvdb	www.osvdb.org/show/osvdb/109622
securityfocus	www.securityfocus.com/bid/68971
osvdb	www.osvdb.org/show/osvdb/109623
osvdb	www.osvdb.org/show/osvdb/109625
packetstormsecurity	www.packetstormsecurity.com/files/127690/SkaDate-Lite-2.0-CSRF-Cross-Site-Scripting.html
exploit-db	www.exploit-db.com/exploits/34190
osvdb	www.osvdb.org/show/osvdb/109624
packetstormsecurity	www.packetstormsecurity.com/files/127652/Oxwall-1.7.0-Cross-Site-Request-Forgery-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
label	request body	admin/users/roles/	CSRF allows crafting requests that inject script via the label parameter	CWE-352
lang[1][base][questions_account_type_5615100a931845eca8da20cfdf7327e0]	request body	admin/questions/ajax-responder/	CSRF enables stored XSS through the lang[...] parameter in AddAccountType action	CWE-352
command	request body	admin/questions/ajax-responder/	CSRF enables stored XSS through the lang[...] parameter in AddAccountType action	CWE-352
key	request body	admin/questions/ajax-responder/	CSRF enables stored XSS through the lang[...] parameter in AddAccountType action	CWE-352
prefix	request body	admin/questions/ajax-responder/	CSRF enables stored XSS through the lang[...] parameter in AddAccountType action	CWE-352
accountTypeName	request body	admin/questions/ajax-responder/	CSRF enables stored XSS through the lang[...] parameter in AddAccountType action	CWE-352
lang[1][base][questions_account_type_5615100a931845eca8da20cfdf7327e0]	request body	admin/questions/ajax-responder/	CSRF enables stored XSS through the lang[...] parameter in AddAccountType action	CWE-352
qst_name	request body	admin/questions/ajax-responder/	CSRF enables stored XSS via the qst_name parameter in addQuestion action	CWE-352
qst_description	request body	admin/questions/ajax-responder/	CSRF enables stored XSS via the qst_name parameter in addQuestion action	CWE-352
qst_account_type[0]	request body	admin/questions/ajax-responder/	CSRF enables stored XSS via the qst_name parameter in addQuestion action	CWE-352

17 Jun 2026 00:17Current

7.3High risk

Vulners AI Score7.3

CVSS 26.8

EPSS0.02425

CWE-352