Unscored severity · published Dec 15, 2006
CVE-2006-6587
Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject…
–
CVSS
8%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject arbitrary web script or HTML by posting a message.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.0% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OFBiz · Apache
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-6587
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-6587
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2006-12/0177.html
securitytracker.com
http://securitytracker.com/id?1017360
www.securityfocus.com
http://www.securityfocus.com/bid/21529
Exploit
https://issues.apache.org/jira/browse/OFBIZ-178
Exploit
https://issues.apache.org/jira/browse/OFBIZ-260
More from OFBiz
9.8
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
9.8
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
7.5
CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
9.8
CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
9.8
CVE-2025-54466
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin