CVE-2025-26865

CVE-2025-26865: FreeMarker Server-Side Template Injection via the "ecommerce" plugin in Apache OfBiz Due to a regression between 18.12.17 and 18.12.18 the fix for finding CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz was no longer enforced which reopened the possibilit...

CVE-2020-9496

CVE-2020-9496 Configuración del entorno vulnerable ▶ wget http://archive.apache.org/dist/ofbiz/apache-ofbiz-17.12.01.zip ▶ unzip apache-ofbiz-17.12.01.zip ▶ cd apache-ofbiz-17.12.01 ▶ sh gradle/init-gradle-wrapper.sh ▶ ./gradlew cleanAll loadDefault ▶ ./gradlew "ofbiz --load-data...

Exploit-CVE-2023-49070-and-CVE-2023-51467-Apache-OFBiz

Exploit CVE-2023-49070 y CVE-2023-51467 Apache OFBiz 18.12.10 Vulnerabilidad de omisión de autenticación en Apache OFBiz Este código de exploit ha sido desarrollado únicamente con fines educativos y para mejorar las prácticas de ciberseguridad. Cualquier uso con fines ilícitos es responsabilidad...

Apache-OFBiz-Exploit

Apache-OFBiz-Exploit Exploit para Apache OFBiz CVE-2024-38856 Por: Alisson Faoli Descripción Este repositorio contiene un exploit para la vulnerabilidad CVE-2024-38856 encontrada en Apache OFBiz. El fallo permite una RCE Ejecución Remota de Código sin autenticación. Nota: Este exploit se...

OFBiz-Attack

OFBiz-Attack A Tool For CVE-2023-49070/CVE-2023-51467 Attack Test Environment vulhub/ofbiz:18.12.09 Usage Start java -jar OFBiz-Attack.jar There are three modules: Vulnerability Detection Just enter the target URL. Do not add extra routes, otherwise it will affect subsequent module exploitation...

Ofbiz-RCE

📌 Apache OFBiz RCE Exploit CVE-2024-38856 Este script de Python permite explotar una vulnerabilidad de tipo Remote Code Execution RCE en Apache OFBiz versiones 18.12.15, mediante un acceso no autorizado al endpoint /webtools/control/forgotPassword/ProgramExport. 🛠️ Descripción CVE : CVE-2024-38856...

Apache-OFBiz-Authentication-Bypass

Vulnerabilidad de Bypass de Autenticación en Apache OFBiz CVE-2023-51467 y CVE-2023-49070 Este script de exploit y PoC están escritos para un análisis detallado de CVE en vsociety. El sistema de planificación de recursos empresariales ERP Apache OFBiz, un marco web versátil basado en Java...

CVE-2023-42793

CVE-2023-42793 For educational purposes only PoC for CVE-2023-42793 Usage CVE-2023-42793admin.sh: chmod +x CVE-2023-42793admin.sh ./CVE-2023-42793admin.sh ip/domainname port Proof of working: Usage CVE-2023-42793rce.sh: chmod +x CVE-2023-42793rce.sh ./CVE-2023-42793rce.sh ip/domainname port comma...

ofbiz-CVE-2023-49070-RCE-POC

ofbiz-CVE-2023-49070-RCE-POC This is a pre-auth RCE POC For CVE-2023-49070 which affected Apache ofbiz applications wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar Dns POC RCE POC This tweets helped me alot :...

CVE-2024-32113-POC

Apache OfBiz vulns POC for CVE-2024-32113 The USERNAME and PASSWORD params can be provided at the /ecomseo/AnonContactus interface, which is publicly accessible to anyone. POC1：RCE curl --noproxy '' -k --location --request POST...

CVE-2024-32113

CVE-2024-32113 Vulnerabilidad de Apache OFBiz de Path traversal que conduce a RCE EXP. Limitación incorrecta de un nombre de ruta a un directorio restringido vulnerabilidad de 'Path Traversal' en Apache OFBiz. Este problema afecta a Apache OFBiz: antes de 18.12.14no incluido. Se recomienda a los...

Apache OFBiz <17.12.06 - Arbitrary Code Execution

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. id: CVE-2021-26295 info: name: Apache OFBiz 17.12.06 - Arbitrary Code Execution author: madrobot severity: critical description: | Apache OFBiz...

CVE-2024-32113

CVE-2024-32113 Apache OFBIZ Escaneo por lote 注意：このツールを違法攻撃に使用することを支援するものではありません。このツールは技術的な交流のみを目的としています。 Nota: Esta herramienta no respalda ningún ataque ilegal. Está destinada únicamente al intercambio técnico. 注意：本人不支持任何人使用本工具进行非法攻击，本工具仅作为技术交流。 Ayuda CVE-2024-32113 Escaneo por lote argumentos...

apache-ofbiz-CVE-2020-9496

apache-ofbiz-CVE-2020-9496 Youtube https://www.youtube.com/watch?v=DO93Xc8sGWg...

CVE-2024-38856_Scanner

CVE-2024-38856 Solo para uso ético. No se permite ninguna actividad dañina o maliciosa. Y es tu responsabilidad. CVE-2024-38856: Escáner y Exploit de ejecución remota de código de Apache OFBiz El análisis del CVE: https://blog.securelayer7.net/cve-2024-38856-apache-ofbiz-rce Este problema afecta ...

CVE-2021-30128-EXP

CVE-2021-30128 Apache OFBiz EXP de vulnerabilidad de deserialización Referencia https://mp.weixin.qq.com/s/Dr-jwiRr4NByjErjiXe1w...

CVE-2020-9496

CVE-2020-9496 Las solicitudes XML-RPC son vulnerables a deserialización insegura y problemas de Cross-Site Scripting en Apache OFBiz 17.12.03 Instalar requisitos $ pip install -r requirements.txt $ wget https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar ...

CVE-2020-9496

CVE-2020-9496 - RCE Because the 2 xmlrpc related requets in webtools xmlrpc and ping are not using authentication they are vulnerable to unsafe deserialization. This issue was reported to the security team by Alvaro Munoz [email protected] from the GitHub Security Lab team. This vulnerabilit...

CVE-2024-36104

CVE-2024-36104 Disclaimer This tool is only for personal security research and learning. Any direct or indirect consequences and losses caused by the dissemination or use of this tool are solely the responsibility of the user. The tool author does not assume any responsibility. version = 18.12.14...

Apache-OFBiz-Directory-Traversal-exploit

Apache-OFBiz-Directory-Traversal-exploit A vulnerability classified as critical, has been found in Apache OFBiz up to 18.12.12. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. The product uses external input to...