CVE-2020-1943
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-1943
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache OFBiz 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache OFBiz是美国阿帕奇（Apache）软件基金会的一套企业资源计划（ERP）系统。该系统提供了一整套基于Java的Web应用程序组件和工具。 Apache OFBiz中存在跨站脚本漏洞。远程攻击者可借助特制的URL利用该漏洞在用户浏览器中执行脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache | Apache OFBiz | 16.11.01 to 16.11.07 | - |
II. Public POCs for CVE-2020-1943
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Apache OFBiz 16.11.01 to 16.11.07 is vulnerable to cross-site scripting because data sent with contentId to /control/stream is not sanitized. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-1943.yaml | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-1943
请登录查看更多情报信息。
Same Patch Batch · Apache · 2020-04-01 · 7 CVEs total
| CVE-2018-11802 | Apache Solr 安全漏洞 | |
| CVE-2019-17564 | Apache Dubbo 安全漏洞 | |
| CVE-2020-1927 | Apache HTTP Server 输入验证错误漏洞 | |
| CVE-2020-1934 | Apache HTTP Server 安全漏洞 | |
| CVE-2020-1954 | Apache CXF 信息泄露漏洞 | |
| CVE-2020-1958 | Apache Druid 注入漏洞 |
IV. Related Vulnerabilities
Same product: Apache OFBiz
- CVE-2025-61623
Apache OFBiz: Reflected Cross-site Scripting - CVE-2025-59118
Apache OFBiz: Critical Remote Command Execution via Unrestri - CVE-2025-54466
Apache OFBiz: RCE Vulnerability in scrum plugin - CVE-2025-30676
Apache OFBiz: Stored XSS Vulnerability - CVE-2025-26865
Apache OFBiz: Server-Side Template Injection affecting the e
Same vendor: Apache
- CVE-2025-58712
Amq: privilege escalation via excessive /etc/passwd permissi - CVE-2024-42362
GHSL-2023-255: HertzBeat Authenticated (user role) RCE via u - CVE-2024-42361
GHSL-2023-256: HertzBeat Authenticated (guest role) SQL inje - CVE-2021-32824
Regular expression Denial of Service in MooTools - CVE-2021-25958
Generation of Error Message Containing Sensitive Information
V. Comments for CVE-2020-1943
No comments yet