https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2011-5145.htmlhttps://patchthecve.com/cve/CVE-2011-5145.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 5.5: Multiple SQL injection vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sel_domain_id or (2) action parameter to obm.php; (3) tf_user parameter in a search action to group/group_index.php;https://patchthecve.com/cve/CVE-2011-5144.htmlhttps://patchthecve.com/cve/CVE-2011-5144.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 5.0: Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote attackers to obtain configuration information via a direct request to test.php, which calls the phpinfo function.https://patchthecve.com/cve/CVE-2011-5143.htmlhttps://patchthecve.com/cve/CVE-2011-5143.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tf_name, (2) tf_delegation, and (3) tf_ip parameters to index.php. NOTE: the provenance of this information is https://patchthecve.com/cve/CVE-2011-5142.htmlhttps://patchthecve.com/cve/CVE-2011-5142.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tf_delegation, (2) tf_ip, or (3) tf_name parameter in a search action to host/host_index.php; (4) login parahttps://patchthecve.com/cve/CVE-2011-5141.htmlhttps://patchthecve.com/cve/CVE-2011-5141.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 6.0: Directory traversal vulnerability in exportcsv/exportcsv_index.php in Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the module parameter in an export_page action.https://patchthecve.com/cve/CVE-2007-2316.htmlhttps://patchthecve.com/cve/CVE-2007-2316.htmlTue, 16 Jun 2026 22:39:21 +0000HIGH 10.0: Unspecified vulnerability in the admin script in Open Business Management (OBM) before 2.0.0 allows remote attackers to have an unknown impact by calling the script "in txt mode from a browser."https://patchthecve.com/cve/CVE-2006-3010.htmlhttps://patchthecve.com/cve/CVE-2006-3010.htmlTue, 16 Jun 2026 22:26:13 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in Open Business Management (OBM) 1.0.3 pl1 allow remote attackers to execute arbitrary SQL commands via the (1) new_order and (2) order_dir parameters to (a) index.php, (b) group/group_index.php, (c) user/user_index.php, (d) list/list_index.php, and (e) companhttps://patchthecve.com/cve/CVE-2006-3009.htmlhttps://patchthecve.com/cve/CVE-2006-3009.htmlTue, 16 Jun 2026 22:26:13 +0000MEDIUM 5.8: Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 1.0.3 pl1 allow remote attackers to inject arbitrary HTML or web script via the (1) tf_lang, (2) tf_name, (3) tf_user, (4) tf_lastname, (5) tf_contact, (6) tf_datebefore, and (7) tf_dateafter parameters to files su