CVE-2026-81815

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...

CVE-2026-81734

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to a missing authorization flaw in the ProductEvents component. A remote authenticated attacker with only catalog view permissions can create, modify, or remove arbitrary product, product feature association, and product category associat...

EUVD-2026-117483

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...