CVE-2026-81815

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...

CVE-2026-81815

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to SQL injection in the entity engine's generic performFind service when using MySQL/MariaDB backends. The root cause is that SqlJdbcUtil.addValueSingle inlines values directly into the SQL text using ANSI-only single-quote doubling inste...

EUVD-2026-117483

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...