CVE-2014-8429

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-11-28 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in Xavoc Technocrats xEpan CMS 1.0.4.1, 1.0.4, 1.0.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts via a crafted request to the owner/users page.

Affected products

Xavoc Xepan Cms: through 1.0.1; 1.0.4, 1.0.4.1

References

http://www.securityfocus.com/archive/1/534096/100/0/threaded
https://www.htbridge.com/advisory/HTB23240
http://www.securityfocus.com/archive/1/534096/100/0/threaded
https://www.htbridge.com/advisory/HTB23240

Get alerted when CVE-2014-8429 or the next vulnerability affects your stack