Unscored severity · published Apr 15, 2010
CVE-2010-0432
Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow…
–
CVSS
22.9%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.
Exploitation
Is it being used?
Exploit prediction (EPSS)22.9% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OFBiz · Apache
through 09.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0432
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0432
Vendor Advisory
http://svn.apache.org/viewvc?view=revision&revision=920369
Vendor Advisory
http://svn.apache.org/viewvc?view=revision&revision=920370
Vendor Advisory
http://svn.apache.org/viewvc?view=revision&revision=920371
Vendor Advisory
http://svn.apache.org/viewvc?view=revision&revision=920372
Vendor Advisory
http://svn.apache.org/viewvc?view=revision&revision=920379
Vendor Advisory
http://svn.apache.org/viewvc?view=revision&revision=920380
More from OFBiz
9.8
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
9.8
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
7.5
CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
9.8
CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
9.8
CVE-2025-54466
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin