CVE-2024-25065

Apache OFBiz (versions prior to 18.12.12 ) is vulnerable to a path traversal flaw caused by incorrect restrictions on the path to the restricted-access catalog. This vulnerability allows a remote attacker to bypass the authentication process and potentially access files and directories stored out...

CVE-2023-51467

CVE-2023-51467 is a documented authentication bypass vulnerability in Apache OFBiz that can enable remote code execution. Multiple connected sources describe pre-authentication bypass paths and post-bypass impact, including potential SSRF or arbitrary code execution. Affected version notes appear...

CVE-2021-26295

Apache OFBiz contains an unsafe Java deserialization vulnerability in requests leading to remote takeover on versions prior to 17.12.06. Multiple sources (including MSF exploit for the SOAP endpoint prior to 17.12.06) describe PoCs/Exploits and DNS-log-based validation. Affected component is OFBi...

CVE-2024-45195

Apache OFBiz versions before 18.12.16 are vulnerable to a Direct Request (Forced Browsing) vulnerability. The root cause is a confused controller-view authorization logic where the application uses different methods to parse the controller and the view map. An attacker can send unexpected URI pat...

CVE-2024-32113

CVE-2024-32113 describes a path traversal vulnerability in Apache OFBiz (affected:

CVE-2023-49070

CVE-2023-49070 is a pre-auth RCE in Apache OFBiz up to version 18.12.09, caused by an unused XML-RPC component that remains present. Affected product: Apache OFBiz before 18.12.10 (and related CVE-2023-51467 authentication-bypass vector). The severity is high (CVSS v3.1 base score 9.8) with netwo...

CVE-2024-38856

CVE-2024-38856 is a pre-authentication remote code execution vulnerability in Apache OFBiz (affected: versions before 18.12.15). The issue arises from an Incorrect Authorization flaw where unauthenticated endpoints can render screens or run code, depending on endpoint configuration and missing ex...

CVE-2024-36104

A path traversal vulnerability in Apache OFBiz (before version 18.12.14) allows unauthenticated remote code execution (RCE) on Linux and Windows. The root cause is the desynchronization of the controller and view map state , where the application uses different methods to parse the request URI fo...

CVE-2024-23946

The CVE-2024-23946 issue is a path traversal/file inclusion vulnerability in Apache OFBiz. Affected product: Apache OFBiz prior to 18.12.12. Root cause: incorrect handling of file paths allowing access to files outside the web root. Impact: potential disclosure of sensitive files/directories; det...

CVE-2021-30128

Apache OFBiz

CVE-2024-45507

CVE-2024-45507 affects Apache OFBiz versions before 18.12.16. The issue combines Server-Side Request Forgery (SSRF) and Code Injection due to missing view authorization, enabling unauthenticated remote code execution on affected servers. Mitigation: upgrade to OFBiz 18.12.16 or later. No explicit...

CVE-2021-29200

Apache OFBiz prior to 17.12.07 is affected by CVE-2021-29200 due to unsafe Java deserialization, enabling unauthenticated remote code execution. The vulnerability arises from processing serialized objects (deserialization) and can be exploited to execute arbitrary code on the server. Expected imp...

CVE-2023-50968

Apache OFBiz

CVE-2022-47501

Apache OFBiz versions prior to 18.12.07 are vulnerable to an arbitrary file reading vulnerability when using the Solr plugin . This is a pre-authentication attack caused by a path traversal flaw where the application fails to properly filter special elements in the path of a resource or file. Una...

CVE-2022-25371

CVE-2022-25371 involves Apache OFBiz with the Birt plugin. A bug in Birt (Eclipse bug 538142) enables a remote code execution (RCE) attack in OFBiz 18.12.05 and earlier. The connected Red Hat/NVD entries confirm the RCE impact and affected version range. No details on a fixed/version upgrade are ...

CVE-2025-30676

Apache OFBiz versions prior to 18.12.19 are vulnerable to a Basic XSS vulnerability due to a lack of adequate protection measures and effective filtering/escaping of user-supplied data in web page structures. A remote attacker can exploit this deficiency to inject and execute arbitrary web script...

CVE-2024-47208

Apache OFBiz (versions before 18.12.17 ) is vulnerable to Server-Side Request Forgery (SSRF) and Code Injection (CWE-94, CWE-918) due to insufficient validation of user-supplied requests. A remote attacker can exploit this flaw to probe internal intranet resources or potentially execute arbitrary...

CVE-2021-37608

CVE-2021-37608 affects Apache OFBiz up to and including 17.12.07; it is caused by Unrestricted Upload of File with Dangerous Type, enabling remote command execution. The advisory calls for upgrading to at least 17.12.08 or applying the OFBIZ-12297 patch. Connected sources confirm the vulnerabilit...

CVE-2022-25813

Apache OFBiz CVE-2022-25813 affects versions 18.12.05 and earlier. An anonymous user can inject malicious content into the Subject field of the ecommerce plugin’s Contact us page, triggering a Server-Side Template Injection (SSTI) when a party manager lists communications, potentially enabling Re...

CVE-2025-59118

Apache OFBiz versions prior to 24.09.03 are vulnerable to an Unrestricted Upload of File with Dangerous Type (CWE-434). This critical flaw allows remote attackers to upload arbitrary files, including malicious scripts, which can lead to Remote Command Execution (RCE) , full system compromise, web...

CVE-2022-29158

CVE-2022-29158 affects Apache OFBiz up to version 18.12.05. The issue is a Regular Expression Denial of Service (ReDoS) in how OFBiz handles URLs provided by external, unauthenticated users. Several trusted sources in the connected set corroborate this vulnerability and the remediation: upgrade t...

CVE-2024-48962

CVE-2024-48962 affects Apache OFBiz versions before 18.12.17. The issue combines improper generation of code (code injection) with CSRF, arising from improper neutralization of certain template elements. This can enable unauthorized actions or code execution within vulnerable OFBiz deployments. T...

CVE-2023-46819

Apache OFBiz contains a Missing Authentication flaw in the Solr plugin (CVE-2023-46819). Affected versions are before 18.12.09. The root cause is unauthorized access to Solr plugin queries, enabling potential modification/exfiltration of protected data. The recommended remediation is upgrading to...

CVE-2022-29063

CVE-2022-29063 affects the Solr plugin in Apache OFBiz. By default it issues a RMI request to localhost:1099; versions 18.12.05 and earlier are vulnerable if an attacker runs a malicious RMI server on localhost, allowing arbitrary code execution at server start-up or on restart. A fix is availabl...

CVE-2022-25370

Summary: CVE-2022-25370 affects Apache OFBiz versions 18.12.05 and earlier, due to a vulnerability in the Birt plugin (Birt issue 538142) that enables an unauthenticated stored XSS attack. The attack can inject and execute a payload via the stored XSS vector. Affected software/component: Apache O...

CVE-2006-6587

CVE-2006-6587 is a Cross‑Site Scripting (XSS) flaw in the Apache OFBiz Open For Business (OFBiz) ecommerce forum component. The vulnerability allows remote attackers to inject arbitrary script or HTML by posting a message, targeting the forum implementation. The connected OpenVAS entry notes OFBi...

CVE-2006-6589

The CVE-2006-6589 entry tracks a cross-site scripting (XSS) vulnerability affecting the ecommerce/control/keywordsearch path in Apache OFBiz and Opentaps 0.9.3, enabling remote injection of script/HTML via the SEARCH_STRING parameter. Connected OpenVAS data confirms HTML injection issues for Open...

CVE-2006-6588

CVE-2006-6588 affects the Apache OFBiz OFBiz forum component, where the forum implementation trusts certain hidden form fields (dataResourceTypeId and contentTypeId) to process content. This trust allows remote attackers to create unauthorized content types, modify content, or cause other unknown...

CVE-2026-45187

Apache OFBiz is affected by an Improper Authorization vulnerability in the Webtools component. This flaw specifically occurs during Scheduled Job Creation , where it allows low-privileged users to submit system jobs . This issue impacts all versions prior to 24.09.06 . To remediate this vulnerabi...

CVE-2026-50223

Apache OFBiz versions prior to 24.09.07 are vulnerable to an Improper Control of Generation of Code (Code Injection) vulnerability. A low-privileged authenticated user with Content/DataResource editing privileges can perform template injection attacks , which may lead to Remote Code Execution (RC...

CVE-2025-54466

CVE-2025-54466 involves an RCE in the Apache OFBiz Scrum plugin caused by improper control of code generation. Affected: Apache OFBiz versions prior to 24.09.02 when the Scrum plugin is used. Exploitation can be performed by unauthenticated attackers, potentially enabling remote code execution. R...

CVE-2020-13923

CVE-2020-13923 is an IDOR vulnerability in the order processing feature of the ERP/commerce component of Apache OFBiz, affecting versions prior to 17.12.04. The connected CNVD entry characterizes the issue as an input validation error that enables bypassing security restrictions and direct access...

CVE-2026-35086

Apache OFBiz versions prior to 24.09.06 are vulnerable to an Improper Control of Generation of Code (Code Injection) vulnerability within its email services . The root cause is attributed to unsafe template expansion , which can lead to Authenticated Remote Code Execution (RCE) . Users are recomm...

CVE-2026-29207

Apache OFBiz versions prior to 24.09.06 are vulnerable to a Server-Side Template Injection (SSTI) flaw caused by the improper neutralization of special elements within the template engine . This vulnerability can lead to Remote Code Execution (RCE) in the content component. Users should upgrade t...

CVE-2026-31906

Apache OFBiz versions prior to 24.09.06 are vulnerable to a Cross-site Scripting (XSS) flaw caused by the improper neutralization of input during web page generation. Specifically, the vulnerability is triggered by improper HTML attribute escaping within Layered-Modal Dialog parameters . This fla...

CVE-2026-46586

Apache OFBiz versions prior to 24.09.06 are vulnerable to Code Injection and Eval Injection due to improper control of code generation and improper neutralization of directives in dynamically evaluated code. Specifically, the traverseContent service fails to properly validate inputs, which can al...

CVE-2026-31986

Apache OFBiz versions prior to 24.09.06 are vulnerable to a Use of Hard-coded Cryptographic Key vulnerability. The root cause is the use of hard-coded encryption keys within the application, which may allow remote attackers to gain unauthorized access , expose sensitive data , or tamper with appl...

CVE-2025-61623

Apache OFBiz versions prior to 24.09.03 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw stems from the improper neutralization of input during web page generation, which could allow an attacker to inject malicious code through user-supplied input. To remediate thi...

CVE-2026-45434

Apache OFBiz versions prior to 24.09.06 are vulnerable to an improper authentication flaw caused by a logic error in the password-change procedures . This vulnerability can lead to Remote Code Execution (RCE) , allowing an attacker to execute arbitrary commands on the target machine. Users are re...

CVE-2026-41919

Apache OFBiz versions prior to 24.09.06 are vulnerable to an LDAP Injection attack due to the improper neutralization of special elements used in LDAP queries. This flaw can specifically lead to an authentication bypass during DN construction. The impact of this vulnerability is rated as CRITICAL...

CVE-2026-31379

Apache OFBiz versions prior to 24.09.06 are vulnerable to a combination of Cross-site Scripting (XSS) , Path Traversal , and Code Injection due to improper input handling. These vulnerabilities specifically affect the Catalog Manager component, where a path traversal and file upload validation by...

CVE-2026-31387

Apache OFBiz is vulnerable to an improper authentication vulnerability in versions prior to 24.09.06 . According to the provided documents, the vulnerability allows for cookie manipulation leading to authenticated JWT forgery and account impersonation . Affected systems include any installations ...

CVE-2026-29220

Apache OFBiz versions prior to 24.09.06 are vulnerable to a Path Traversal vulnerability due to improper limitation of pathnames to a restricted directory. This flaw may allow an attacker to access files or directories outside of the intended scope. Specifically, a low-privilege Local File Inclus...

CVE-2026-31380

Apache OFBiz versions prior to 24.09.06 are vulnerable to an Expression Language Injection flaw caused by the improper neutralization of special elements within expression language statements. Specifically, a FreeMarker SSTI (Server-Side Template Injection) can occur via a duplicate parameter san...

CVE-2026-31378

Apache OFBiz is vulnerable to an Improper Input Validation flaw in versions prior to 24.09.06 . Technical details from related records indicate that JSON Attribute Override and URL Allowlist Bypass can lead to Remote Code Execution . To remediate this vulnerability, users are recommended to upgra...

CVE-2026-31910

Apache OFBiz is affected by a Server-Side Request Forgery (SSRF) vulnerability in versions before 24.09.06 . The root cause is attributed to improper input validation within the UI Factory classes , which can lead to SSRF and blind file access . To remediate this issue, users are recommended to u...

CVE-2026-29226

Apache OFBiz versions prior to 24.09.06 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The flaw is located within the Content component operations. This vulnerability allows for unauthorized requests from the server side. To mitigate this issue, users are recommended to upg...

CVE-2026-31388

Apache OFBiz is vulnerable to an improper access control vulnerability in multi-tenant deployments . Specifically, the Program Export Feature allows for cross-tenant data exposure . This issue affects versions prior to 24.09.06 . To remediate this vulnerability, users are recommended to upgrade t...

CVE-2026-47342

CVE-2026-47342 affects Apache OFBiz prior to 24.09.07 and is a privilege-escalation via updateOrRemove authorization bypass. The issue allows a low-privileged authenticated user to obtain higher privileges. The advisory recommends upgrading to 24.09.07 to fix the vulnerability. CVSS 3.1 base scor...

CVE-2026-31909

Apache OFBiz versions prior to 24.09.06 are vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. The flaw allows unauthorized attackers to access sensitive data, specifically identified in some records as an Unauthenticated Shipment Label Image Disclosure . T...