CVE-2026-82912

Improper Neutralization of Special Elements Used in an Expression Language Statement 'Expression Language Injection' in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and ACCOUNTINGVIEW, the two view-level...

CVE-2026-82912

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to an Expression Language Injection in the EmailServices component. A remote authenticated attacker requiring only OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions can execute arbitrary operating system commands as the accou...

CVE-2026-82912 Apache OFBiz: Unsandboxed Groovy compiled from a service parameter

Improper Neutralization of Special Elements Used in an Expression Language Statement 'Expression Language Injection' in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and ACCOUNTINGVIEW, the two view-level...