Unscored severity · published Jan 2, 2015
CVE-2014-9459
Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E1
E107 · E107
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9459
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9459
packetstormsecurity.com
http://packetstormsecurity.com/files/129751/e107-2.0-Alpha2-Cross-Site-Request-Forgery.html
seclists.org
http://seclists.org/fulldisclosure/2014/Dec/124
sroesemann.blogspot.de
http://sroesemann.blogspot.de/2014/12/sroeadv-2014-04.html
github.com
https://github.com/e107inc/e107/commit/9249f892b1e635979db2a830393694fb73531080
More from E107
9.8
CVE-2026-72599
e107 e107 - SQL Injection
8.8
CVE-2021-27885
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism
8.8
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC
8.8
CVE-2018-15901
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators
8.1
CVE-2025-11941
e107 CMS Avatar image.php path traversal