CVE-2026-73580

Apache OFBiz versions through 24.09.07 on all platforms are vulnerable to an unauthenticated remote disclosure of Human Resources data. A missing authorization check in the getHRChild service allows an attacker to recursively enumerate sensitive information, including department names, identifier...

CVE-2010-0432

Multiple cross-site scripting XSS vulnerabilities in the Apache Open For Business Project aka OFBiz 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via 1 the productStoreId parameter to control/exportProductListing, 2...