Skip to contentApache Software Foundation Ofbiz vulnerabilities
- apache ofbizApache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System JobsCVE-2026-451876.5 Medium
- apache ofbizApache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN ConstructionCVE-2026-419199.1 Critical
- apache ofbizApache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email servicesCVE-2026-350866.5 Medium
- apache ofbizApache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template InjectionCVE-2026-319869.1 Critical
- apache ofbizApache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File AccessCVE-2026-319107.5 High
- apache ofbizApache OFBiz: Unauthenticated Shipment Label Image DisclosureCVE-2026-319097.5 High
- apache ofbizApache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog ParametersCVE-2026-319066.1 Medium
- apache ofbizApache OFBiz: Cross-Tenant Data Exposure via Program Export FeatureCVE-2026-313885.3 Medium
- apache ofbizApache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account ImpersonationCVE-2026-313875.3 Medium
- apache ofbizApache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization BypassCVE-2026-313806.5 Medium
- apache ofbizApache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog ManagerCVE-2026-313796.1 Medium
- apache ofbizApache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code ExecutionCVE-2026-313786.5 Medium
- apache ofbizApache OFBiz: Low-Privilege SSRF in Content ComponentCVE-2026-292267.3 High
- apache ofbizApache OFBiz: Low-Privilege SSTI Leading to RCE in the Content ComponentCVE-2026-292076.5 Medium
- apache ofbizApache OFBiz: Low-Privilege LFI in Content ComponentCVE-2026-292206.5 Medium
- apache ofbizApache OFBiz: Reflected Cross-site ScriptingCVE-2025-616236.5 Medium
- apache ofbizApache OFBiz: Critical Remote Command Execution via Unrestricted File UploadCVE-2025-591187.3 High
- apache ofbizApache OFBiz: RCE Vulnerability in scrum pluginCVE-2025-54466EPSS 28.8%9.8 Critical
- apache ofbizApache OFBiz: Stored XSS VulnerabilityCVE-2025-30676EPSS 67.6%6.1 Medium
- apache ofbizApache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCECVE-2025-26865Public exploit3.5 Low
- apache ofbizApache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCECVE-2024-472089.8 Critical
- apache ofbizApache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)CVE-2024-489628.9 High
- apache ofbizApache OFBiz: Confused controller-view authorization logic (forced browsing)CVE-2024-45195In KEVPublic exploitEPSS 100.0%7.5 High
- apache ofbizApache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCECVE-2024-45507Public exploitEPSS 96.4%9.8 Critical
- apache ofbizApache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeCVE-2024-38856In KEVPublic exploitEPSS 99.4%9.8 Critical
- apache ofbizApache OFBiz: Path traversal leading to a RCECVE-2024-36104Public exploitEPSS 87.9%9.1 Critical
- apache ofbizApache OFBiz: Path traversal leading to RCECVE-2024-32113In KEVPublic exploitEPSS 99.9%9.8 Critical
- apache ofbizApache OFBiz: Path traversal or file inclusionCVE-2024-239465.3 Medium
- apache ofbizApache OFBiz: Path traversal allowing authentication bypass.CVE-2024-25065EPSS 47.7%9.1 Critical
- apache ofbizApache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerabilityCVE-2023-51467Public exploitEPSS 96.0%9.8 Critical
- apache ofbizApache OFBiz: Arbitrary file properties reading and SSRF attackCVE-2023-50968EPSS 63.4%7.5 High
- apache ofbizPre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentCVE-2023-49070Public exploitEPSS 95.4%9.8 Critical
- apache ofbizApache OFBiz: Execution of Solr plugin queries without authenticationCVE-2023-468195.3 Medium
- apache ofbizApache OFBiz: Arbitrary file reading vulnerabilityCVE-2022-47501EPSS 10.2%7.5 High
- apache ofbizRegular Expression Denial of Service (ReDoS) vulnerability in Apache OFBizCVE-2022-291587.5 High
- apache ofbizJava Deserialization via RMI Connection from the Solr plugin of Apache OFBizCVE-2022-29063Public exploit9.8 Critical
- apache ofbizServer-Side Template Injection affecting the ecommerce plugin of Apache OFBizCVE-2022-25813Public exploitEPSS 67.3%7.5 High
- apache ofbizUnauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizCVE-2022-253719.8 Critical
- apache ofbizUnauth Stored XSS vulnerability in the Birt plugin of Apache OFBizCVE-2022-253705.4 Medium
- apache ofbizArbitrary file upload vulnerability in OFBizCVE-2021-376089.8 Critical
- apache ofbizUnsafe deserialization in Apache OFBizCVE-2021-30128Public exploitEPSS 81.2%9.8 Critical
- apache ofbizRCE vulnerability in latest Apache OFBiz due to Java serialisation using RMICVE-2021-29200Public exploitEPSS 55.4%9.8 Critical
- apache ofbizRCE vulnerability in latest Apache OFBiz due to Java serialisation using RMICVE-2021-26295Public exploitEPSS 97.8%9.8 Critical
- apache ofbizXML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in...CVE-2020-9496Public exploitEPSS 98.9%6.1 Medium
- apache ofbizIDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz...CVE-2020-139235.3 Medium
- apache ofbizApache OFBiz 17.12.01 is vulnerable to some CSRF attacks.CVE-2019-0235Public exploitEPSS 32.7%8.8 High
- apache ofbizApache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary hostCVE-2019-124257.5 High
- apache ofbizData sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache...CVE-2020-1943EPSS 97.2%6.1 Medium
- apache ofbizan unauthenticated user could get access to information of some backend screens by invoking...CVE-2019-124265.3 Medium
- apache ofbizIn Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine...CVE-2018-8033Public exploitEPSS 25.7%7.5 High
- Show moreLoading…