CVE-2013-0177: Apache OFBiz

Low severity, CVSS 3.5. EPSS: 21.2% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.

Affected products

• Apache OFBiz: version 09.04 only; version 09.04.01 only; version 10.04 only; version 10.04.01 only; version 10.04.02 only; version 10.04.03 only; …

Published 2014-01-30. Last modified 2026-06-16.