PatchTheCVE: obmhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2011-5145: Multiple SQL injection vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allowhttps://patchthecve.com/cve/CVE-2011-5145.htmlhttps://patchthecve.com/cve/CVE-2011-5145.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 5.5: Multiple SQL injection vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sel_domain_id or (2) action parameter to obm.php; (3) tf_user parameter in a search action to group/group_index.php;CVE-2011-5144: Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote attackers to obtain configuration informathttps://patchthecve.com/cve/CVE-2011-5144.htmlhttps://patchthecve.com/cve/CVE-2011-5144.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 5.0: Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote attackers to obtain configuration information via a direct request to test.php, which calls the phpinfo function.CVE-2011-5143: Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.3.20 and probably earlhttps://patchthecve.com/cve/CVE-2011-5143.htmlhttps://patchthecve.com/cve/CVE-2011-5143.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tf_name, (2) tf_delegation, and (3) tf_ip parameters to index.php. NOTE: the provenance of this information is CVE-2011-5142: Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably https://patchthecve.com/cve/CVE-2011-5142.htmlhttps://patchthecve.com/cve/CVE-2011-5142.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tf_delegation, (2) tf_ip, or (3) tf_name parameter in a search action to host/host_index.php; (4) login paraCVE-2011-5141: Directory traversal vulnerability in exportcsv/exportcsv_index.php in Open Business Management (OBM) 2.4.0-rc1https://patchthecve.com/cve/CVE-2011-5141.htmlhttps://patchthecve.com/cve/CVE-2011-5141.htmlTue, 16 Jun 2026 23:36:01 +0000MEDIUM 6.0: Directory traversal vulnerability in exportcsv/exportcsv_index.php in Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the module parameter in an export_page action.