CVE-2006-6587 json
Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OF…
published 2006-12-15 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-6570
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.0%
- EPSS 8.0% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject arbitrary web script or HTML by posting a message.
Exploit prediction
7.99% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- archives.neohapsis.com http://archives.neohapsis.com/archives/fulldisclosure/2006-12/0177.html referenced PoC, tagged "exploit" by a source, unverified
- issues.apache.org https://issues.apache.org/jira/browse/OFBIZ-260 referenced PoC, tagged "exploit" by a source, unverified
- issues.apache.org https://issues.apache.org/jira/browse/OFBIZ-178 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
References
-
archives.neohapsis.com
/archives/fulldisclosure/2006-12/0177.html
mailing-list, exploit
-
issues.apache.org
/jira/browse/OFBIZ-260
exploit
-
issues.apache.org
/jira/browse/OFBIZ-178
exploit
-
securitytracker.com
/id?1017360
vdb-entry
-
securityfocus.com
/bid/21529
vdb-entry
Sources
- CVE List CVE-2006-6587
- NVD CVE-2006-6587
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.