CVE-2010-0432

Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.

• CWE-79

• http://svn.apache.org/viewvc?view=revision&revision=920369Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920370Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920371Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920372Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920379Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920380Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920381Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920382Vendor Advisory
• http://www.bonsai-sec.com/en/research/vulnerabilities/apacheofbiz-multiple-xss-0103.phpExploit, Third Party Advisory
• http://www.securityfocus.com/bid/39489Exploit, Third Party Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920369Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920370Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920371Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920372Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920379Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920380Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920381Vendor Advisory
• http://svn.apache.org/viewvc?view=revision&revision=920382Vendor Advisory
• http://www.bonsai-sec.com/en/research/vulnerabilities/apacheofbiz-multiple-xss-0103.phpExploit, Third Party Advisory
• http://www.securityfocus.com/bid/39489Exploit, Third Party Advisory

Published

Apr 15, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-0426sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a …
• CVE-2010-0427sudo 1.6.x before 1.6.9p21, when the runas_default option is…
• CVE-2010-0428libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hy…
• CVE-2010-0429libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hy…
• CVE-2010-0430libspice, as used in QEMU-KVM in Red Hat Enterprise Virtuali…
• CVE-2010-0431QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in…
• CVE-2010-0433The kssl_keytab_is_available function in ssl/kssl.c in OpenS…
• CVE-2010-0434The ap_read_request function in server/protocol.c in the Apa…
• CVE-2010-0435The Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise V…
• CVE-2010-0436Race condition in backend/ctrl.c in KDM in KDE Software Comp…
• CVE-2010-0437The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in…
• CVE-2010-0438Multiple SQL injection vulnerabilities in Kernel/System/Tick…