CVE-2014-5100

Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_label parameter to admin/users/api-keys/1, or (3) disable file validation via a request to admin/settings/edit-security.

• CWE-352

• http://omeka.org/blog/2014/07/16/omeka-2-2-1-security-update-releasedPatch, Vendor Advisory
• http://omeka.org/codex/Release_Notes_for_2.2.1Vendor Advisory
• http://packetstormsecurity.com/files/127523/Omeka-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit
• http://www.exploit-db.com/exploits/34100Exploit
• http://www.securityfocus.com/bid/68707Exploit
• http://www.zeroscience.mk/codes/omeka_csrfxss.txtExploit
• http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5193.phpExploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94689
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94690
• http://omeka.org/blog/2014/07/16/omeka-2-2-1-security-update-releasedPatch, Vendor Advisory
• http://omeka.org/codex/Release_Notes_for_2.2.1Vendor Advisory
• http://packetstormsecurity.com/files/127523/Omeka-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.htmlExploit
• http://www.exploit-db.com/exploits/34100Exploit
• http://www.securityfocus.com/bid/68707Exploit
• http://www.zeroscience.mk/codes/omeka_csrfxss.txtExploit
• http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5193.phpExploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94689
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94690

Published

Jul 25, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-5091A vulnerability exits in Status2K 2.5 Server Monitoring Soft…9.8
• CVE-2014-5092Status2k allows Remote Command Execution in admin/options/ed…8.8
• CVE-2014-5093Status2k does not remove the install directory allowing cred…9.8
• CVE-2014-5094Status2k allows remote attackers to obtain configuration inf…
• CVE-2014-5097Multiple SQL injection vulnerabilities in Free Reprintables …
• CVE-2014-5098Cross-site scripting (XSS) vulnerability in the Search modul…
• CVE-2014-5101Multiple cross-site scripting (XSS) vulnerabilities in WeBid…
• CVE-2014-5102SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3…
• CVE-2014-5103Cross-site scripting (XSS) vulnerability in ZOHO ManageEngin…
• CVE-2014-5104Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 …
• CVE-2014-5105Multiple cross-site scripting (XSS) vulnerabilities in ol-co…
• CVE-2014-5106Cross-site scripting (XSS) vulnerability in Invision Power I…