7 matches found
CVE-2026-81816
XML External Entity XXE Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource...
CVE-2026-82894
Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side...
CVE-2026-81816
Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to an XML External Entity (XXE) Injection in the ContentWorker component. A remote authenticated attacker with content-author permissions can store a crafted text/xml DataResource containing an external entity declaration. Because the ren...
EUVD-2026-117482
XML External Entity XXE Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource...
CVE-2026-81816 Apache OFBiz: XML external entity injection (XXE)
XML External Entity XXE Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource...
CVE-2026-82894
Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to an Improper Authorization flaw in the ContentWorker component. An unauthenticated remote attacker can trigger arbitrary OFBiz service invocations by requesting the showHelpPublic view against a Content row where a serv...
EUVD-2026-117480
Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side...