UpHeron
All vulnerabilities

Servers and applications

CVE-2013-0177

Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to…

Severity
Low 3.5
Published
30 Jan 2014
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
21% in the next 30 daysHigher than 97% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · Needs a login
Attacker can
Change some data
CVSS vector
AV:N/AC:M/Au:S/C:N/I:P/A:N
Sources
NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.

From NVD.

Affected software

SoftwareAffected versions
Apache OFBizServers and applications · cpe:a:apache:ofbiz
  • Version 11.04.01
  • Version 10.04.04
  • Version 10.04.03
  • Version 10.04.02
All 8 release lines
  • Version 09.04
  • Version 09.04.01
  • Version 10.04
  • Version 10.04.01
  • Version 10.04.02
  • Version 10.04.03
  • Version 10.04.04
  • Version 11.04.01

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2013-0177
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2013-0177