CVE

CVE-2011-3600

7.5

CVSS

Description

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.

Attack Vector

Privileges Req.

User Interaction

ofbiz

Updated Oct 12, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2011-3600 Scanner

CVE-2011-3600 Scanner - XML External Entity (XXE) vulnerability in Apache OFBiz

Used 2.6k times · 3.4k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: ofbiz

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →