CVE-2014-9101

🗓️ 26 Nov 2014 15:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

Multiple CSRF vulnerabilities in Oxwall 1.7.0 and SkaDate Lite 2.0 allow remote attackers to hijack authentication of administrators for XSS attacks

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2014-9101	26 Nov 201415:00	–	cvelist
EUVD	EUVD-2014-8927	7 Oct 202500:30	–	euvd
NVD	CVE-2014-9101	26 Nov 201415:59	–	nvd
Prion	Cross site request forgery (csrf)	26 Nov 201415:59	–	prion
RedhatCVE	CVE-2014-9101	22 May 202513:44	–	redhatcve
Zero Science Lab	Oxwall 1.7.0 Multiple CSRF And HTML Injection Vulnerabilities	28 Jul 201400:00	–	zeroscience
Zero Science Lab	SkaDate Lite 2.0 Multiple XSRF And Persistent XSS Vulnerabilities	30 Jul 201400:00	–	zeroscience

NVD

Node

Node

Source	Link
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5197.php
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5195.php
osvdb	www.osvdb.org/show/osvdb/109622
securityfocus	www.securityfocus.com/bid/68971
osvdb	www.osvdb.org/show/osvdb/109623
osvdb	www.osvdb.org/show/osvdb/109625
packetstormsecurity	www.packetstormsecurity.com/files/127690/SkaDate-Lite-2.0-CSRF-Cross-Site-Scripting.html
exploit-db	www.exploit-db.com/exploits/34190
osvdb	www.osvdb.org/show/osvdb/109624
packetstormsecurity	www.packetstormsecurity.com/files/127652/Oxwall-1.7.0-Cross-Site-Request-Forgery-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
label	request body	/admin/users/roles/	CSRF/XSS via label parameter in Add Role form	CWE-352
lang[1][base][questions_account_type_5615100a931845eca8da20cfdf7327e0]	nested	/admin/questions/ajax-responder/	CSRF/XSS via language-specific account type parameter in AddAccountType action	CWE-352
qst_name	request body	/admin/questions/ajax-responder/	CSRF/XSS via qst_name parameter in addQuestion action	CWE-352
form_name	request body	/admin/restricted-usernames	CSRF/XSS via form_name parameter in restricted-usernames form	CWE-352
restrictedUsername	request body	/admin/restricted-usernames	CSRF/XSS via restrictedUsername parameter in restricted-usernames form	CWE-352

06 May 2026 22:30Current

7.3High risk

Vulners AI Score7.3

CVSS 26.8

EPSS0.02778