CVE-2026-45434 Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE

Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...

CVE-2010-0432

Multiple cross-site scripting XSS vulnerabilities in the Apache Open For Business Project aka OFBiz 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via 1 the productStoreId parameter to control/exportProductListing, 2...

EUVD-2025-124975

Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue...

EUVD-2013-0215

Malware in sbrugna...

EUVD-2012-3461

Malware in sbrugna...

EUVD-2013-2102

Malware in sbrugna...

EUVD-2006-6572

Malware in sbrugna...

EUVD-2006-6571

Malware in sbrugna...

EUVD-2012-1631

Malware in sbrugna...

CVE-2006-6588

The forum implementation in the ecommerce component in the Apache Open For Business Project OFBiz trusts the 1 dataResourceTypeId, 2 contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown...

CVE-2012-1621

Multiple cross-site scripting XSS vulnerabilities in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via 1 a parameter array in freemarker templates, the 2 contentId or 3 mapKey parameter in a cms event request, whic...

PT-2014-2234

Name of the Vulnerable Software and Affected Versions Apache Open For Business Project aka OFBiz versions 10.04.x through 10.04.01 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML...

CVE-2012-1621: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via 1 a parameter array in freemarker templates, the 2 contentId or 3 mapKey parameter in a cms event request, whic...

CVE-2013-0177

Multiple cross-site scripting XSS vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the 1 Screenlet.title or 2...

PT-2014-2429

Name of the Vulnerable Software and Affected Versions Apache Open For Business Project aka OFBiz versions 10.04.x through 10.04.04 Apache Open For Business Project aka OFBiz version 11.04.01 Apache Open For Business Project aka OFBiz versions 09.04.x and earlier Description The issue concerns...

CVE-2013-0177: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project aka OFBiz 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the 1 Screenlet.title or 2...

CVE-2013-2137

Cross-site scripting XSS vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project aka OFBiz 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-2250

Apache Open For Business Project aka OFBiz 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language UEL functions via JUEL metacharacters in unspecified parameters, related to nested expressions...

CVE-2013-2137

CVE-2013-2137 describes an XSS vulnerability in the Webtools "View Log" screen of Apache OFBiz. Affected: OFBiz Webtools View Log in versions 10.04.01–10.04.05, 11.04.01–11.04.02, and 12.04.01. Root cause: log HTML content not properly encoded. Impact: remote attackers can inject arbitrary script...

CVE-2013-2137: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project aka OFBiz 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...