CVE-2026-115740

A Server-Side Request Forgery (SSRF) vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier. The flaw resides in the OpenEventEvidenceFile.do endpoint, where the Prefix parameter fails to validate arbitrary UNC paths. An attacker can provide a malicious UNC path, causing t...

CVE-2026-81816

XML External Entity XXE Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource...

CVE-2026-81828

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and...

CVE-2026-82894

Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side...

Webasyst Shop-Script CMS Insufficient Testing

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in insufficient testing of server-side requests. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

SSTImap

SSTImap This project is based on Tplmap. SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive...

CVE-2026-85627

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as th...

CVE-2026-82902

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions OFBTOOLSVIEW, WEBTOOLSVIEW to cause the server to issue arbitrary outbound HTTP requests, and an attacker additional...

CVE-2026-82910

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

CVE-2026-81816

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to an XML External Entity (XXE) Injection in the ContentWorker component. A remote authenticated attacker with content-author permissions can store a crafted text/xml DataResource containing an external entity declaration. Because the ren...

EUVD-2026-117482

XML External Entity XXE Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource...

CVE-2026-81828

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to a Server-Side Request Forgery (SSRF) in the SurveyWrapper component. An authenticated back-office user with catalog permission can trigger the server to fetch and render content from arbitrary URLs—including internal networks, cloud-me...

EUVD-2026-117481

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and...

CVE-2026-82894

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to an Improper Authorization flaw in the ContentWorker component. An unauthenticated remote attacker can trigger arbitrary OFBiz service invocations by requesting the showHelpPublic view against a Content row where a serv...

EUVD-2026-117480

Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side...

CVE-2026-82910 Apache OFBiz: renderLink compiles link parameters as FreeMarker source

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

EUVD-2026-117476

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

CVE-2026-82910

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

CVE-2026-85627

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to a Server-Side Template Injection (SSTI) vulnerability. A remote authenticated attacker with a non-administrative account can execute arbitrary operating system commands as the OFBiz process user. The root cause involves the updateLayou...

EUVD-2026-117467

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as th...