CVE-2006-6589: Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business...

Security readout for executives and security teams

This is an old reflected cross-site scripting issue in Apache OFBiz and Opentaps 0.9.3 keyword search. If exposed, an attacker could make a user’s browser run attacker-supplied script or HTML in the site context. The source bundle does not provide severity scoring, patch details, or evidence of active exploitation. Exposure is most likely in legacy Apache OFBiz or Opentaps 0.9.3 deployments with the ecommerce keyword search route reachable by users or the internet. The provided affected-product metadata is incomplete, so inventory should rely on product usage and route presence, not CPE data. Prioritize based on exposure. Internet-facing legacy ecommerce systems deserve prompt review because XSS can affect customers, sessions, and brand trust. Internal or retired systems are lower urgency, but the missing severity and fix metadata mean teams should validate rather than assume safety. Mitigation focus: Check Apache OFBiz and Opentaps vendor guidance for affected versions and fixes.; Upgrade or retire unsupported legacy OFBiz or Opentaps deployments.; Restrict public access to affected ecommerce search routes where possible..

Prepared

Jun 29, 2026, 08:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.