Apache Ofbiz vulnerabilities

• apache ofbiz Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass CVE-2026-47342 8.8 HighJune 10, 2026
• apache ofbiz Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution CVE-2026-50223 8.8 HighJune 10, 2026
• apache ofbiz Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution CVE-2026-46586 8.8 HighMay 19, 2026
• apache ofbiz Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE CVE-2026-45434 EPSS 21.3% 9.8 CriticalMay 19, 2026
• apache ofbiz Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs CVE-2026-45187 6.5 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction CVE-2026-41919 9.1 CriticalMay 19, 2026
• apache ofbiz Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services CVE-2026-35086 6.5 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection CVE-2026-31986 9.1 CriticalMay 19, 2026
• apache ofbiz Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access CVE-2026-31910 7.5 HighMay 19, 2026
• apache ofbiz Apache OFBiz: Unauthenticated Shipment Label Image Disclosure CVE-2026-31909 7.5 HighMay 19, 2026
• apache ofbiz Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters CVE-2026-31906 6.1 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature CVE-2026-31388 5.3 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation CVE-2026-31387 5.3 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass CVE-2026-31380 6.5 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager CVE-2026-31379 6.1 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution CVE-2026-31378 6.5 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: Low-Privilege SSRF in Content Component CVE-2026-29226 7.3 HighMay 19, 2026
• apache ofbiz Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component CVE-2026-29207 6.5 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: Low-Privilege LFI in Content Component CVE-2026-29220 6.5 MediumMay 19, 2026
• apache ofbiz Apache OFBiz: Reflected Cross-site Scripting CVE-2025-61623 6.5 MediumNovember 12, 2025
• apache ofbiz Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload CVE-2025-59118 7.3 HighNovember 12, 2025
• apache ofbiz Apache OFBiz: RCE Vulnerability in scrum plugin CVE-2025-54466 EPSS 28.0% 9.8 CriticalAugust 15, 2025
• apache ofbiz Apache OFBiz: Stored XSS Vulnerability CVE-2025-30676 EPSS 67.6% 6.1 MediumApril 1, 2025
• apache ofbiz Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE CVE-2025-26865 Public exploit 3.5 LowMarch 10, 2025
• apache ofbiz Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE CVE-2024-47208 9.8 CriticalNovember 18, 2024
• apache ofbiz Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE) CVE-2024-48962 8.9 HighNovember 18, 2024
• apache ofbiz Apache OFBiz: Confused controller-view authorization logic (forced browsing) CVE-2024-45195 In KEVPublic exploit EPSS 100.0% 7.5 HighSeptember 4, 2024
• apache ofbiz Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE CVE-2024-45507 Public exploit EPSS 96.4% 9.8 CriticalSeptember 4, 2024
• apache ofbiz Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code CVE-2024-38856 In KEVPublic exploit EPSS 99.4% 9.8 CriticalAugust 5, 2024
• apache ofbiz Apache OFBiz: Path traversal leading to a RCE CVE-2024-36104 Public exploit EPSS 87.9% 9.1 CriticalJune 4, 2024
• apache ofbiz Apache OFBiz: Path traversal leading to RCE CVE-2024-32113 In KEVPublic exploit EPSS 99.9% 9.8 CriticalMay 8, 2024
• apache ofbiz Apache OFBiz: Path traversal or file inclusion CVE-2024-23946 5.3 MediumFebruary 28, 2024
• apache ofbiz Apache OFBiz: Path traversal allowing authentication bypass. CVE-2024-25065 EPSS 47.7% 9.1 CriticalFebruary 28, 2024
• apache ofbiz Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability CVE-2023-51467 Public exploit EPSS 96.0% 9.8 CriticalDecember 26, 2023
• apache ofbiz Apache OFBiz: Arbitrary file properties reading and SSRF attack CVE-2023-50968 EPSS 63.4% 7.5 HighDecember 26, 2023
• apache ofbiz Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present CVE-2023-49070 Public exploit EPSS 95.4% 9.8 CriticalDecember 5, 2023
• apache ofbiz Apache OFBiz: Execution of Solr plugin queries without authentication CVE-2023-46819 5.3 MediumNovember 7, 2023
• apache ofbiz Apache OFBiz: Arbitrary file reading vulnerability CVE-2022-47501 EPSS 10.2% 7.5 HighApril 14, 2023
• apache ofbiz Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz CVE-2022-29158 7.5 HighSeptember 2, 2022
• apache ofbiz Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz CVE-2022-29063 Public exploit 9.8 CriticalSeptember 2, 2022
• apache ofbiz Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz CVE-2022-25813 Public exploit EPSS 67.3% 7.5 HighSeptember 2, 2022
• apache ofbiz Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz CVE-2022-25371 9.8 CriticalSeptember 2, 2022
• apache ofbiz Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz CVE-2022-25370 5.4 MediumSeptember 2, 2022
• apache ofbiz, ofbiz-framework +1 more Generation of Error Message Containing Sensitive Information in Apache OFBiz CVE-2021-25958 6.5 MediumAugust 30, 2021
• apache ofbiz Arbitrary file upload vulnerability in OFBiz CVE-2021-37608 9.8 CriticalAugust 18, 2021
• apache ofbiz Unsafe deserialization in Apache OFBiz CVE-2021-30128 Public exploit EPSS 81.2% 9.8 CriticalApril 27, 2021
• apache ofbiz RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI CVE-2021-29200 Public exploit EPSS 55.4% 9.8 CriticalApril 27, 2021
• apache ofbiz RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI CVE-2021-26295 Public exploit EPSS 97.8% 9.8 CriticalMarch 22, 2021
• apache ofbiz XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in... CVE-2020-9496 Public exploit EPSS 98.9% 6.1 MediumJuly 15, 2020
• apache ofbiz IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz... CVE-2020-13923 5.3 MediumJuly 15, 2020
• Show olderLoading…