CVE-2014-8429

published 2014-11-28

CVE-2014-8429: Cross-site request forgery (CSRF) vulnerability in Xavoc Technocrats xEpan CMS 1.0.4.1, 1.0.4, 1.0.1, and earlier allows remote attackers to hijack the…

Priority P3 35 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

EXPLOIT

Cross-site request forgery (CSRF) vulnerability in Xavoc Technocrats xEpan CMS 1.0.4.1, 1.0.4, 1.0.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts via a crafted request to the owner/users page.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
xavoc	xepan_cms	<= 1.0.1	—
xavoc	xepan_cms	—	—
xavoc	xepan_cms	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352