CVE-2011-5142

Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tf_delegation, (2) tf_ip, or (3) tf_name parameter in a search action to host/host_index.php; (4) login parameter to obm.php; or (5) tf_user parameter in a search action to group/group_index.php.

• CWE-79

• http://osvdb.org/78007
• http://osvdb.org/78008
• http://secunia.com/advisories/47139Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71923
• https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_obm.htmlExploit, Vendor Advisory
• http://osvdb.org/78007
• http://osvdb.org/78008
• http://secunia.com/advisories/47139Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71923
• https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_obm.htmlExploit, Vendor Advisory

Published

Aug 31, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-5136showImg.php in EPractize Labs Subscription Manager, possibly…
• CVE-2011-5137Multiple SQL injection vulnerabilities in tForum b0.915 allo…
• CVE-2011-5138Cross-site scripting (XSS) vulnerability in member.php in tF…
• CVE-2011-5139SQL injection vulnerability in page.php in Pre Studio Busine…
• CVE-2011-5140Multiple SQL injection vulnerabilities in the blog module 1.…
• CVE-2011-5141Directory traversal vulnerability in exportcsv/exportcsv_ind…
• CVE-2011-5143Multiple cross-site scripting (XSS) vulnerabilities in Open …
• CVE-2011-5144Open Business Management (OBM) 2.4.0-rc13 and earlier allows…
• CVE-2011-5145Multiple SQL injection vulnerabilities in Open Business Mana…
• CVE-2011-5146Bokken before 1.6 and 1.5-x before 1.5-3 for Debian allows l…
• CVE-2011-5147Static code injection vulnerability in ajax_save_name.php in…
• CVE-2011-5148Multiple incomplete blacklist vulnerabilities in the Simple …