Ofbiz (Apache) - vulnerabilities (CVEs)

76 CVEs, 0 in the last 30 days, 71 known versions, newest CVE from 2026-06-10. Vendor: Apache.

CVEs of Ofbiz

CVE-2026-50223 - CVSS 8.8 (high), 2026-06-10: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource…
CVE-2026-47342 - CVSS 8.8 (high), 2026-06-10: A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz:…
CVE-2026-35086 - CVSS 6.5 (medium), 2026-05-19: Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06.…
CVE-2026-45434 - CVSS 9.8 (critical), 2026-05-19: Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before…
CVE-2026-31986 - CVSS 9.1 (critical), 2026-05-19: Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to…
CVE-2026-45187 - CVSS 6.5 (medium), 2026-05-19: Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version…
CVE-2026-31910 - CVSS 7.5 (high), 2026-05-19: Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to…
CVE-2026-41919 - CVSS 9.1 (critical), 2026-05-19: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before…
CVE-2026-46586 - CVSS 8.8 (high), 2026-05-19: Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')…
CVE-2026-31378 - CVSS 6.5 (medium), 2026-05-19: Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version…
CVE-2026-31387 - CVSS 5.3 (medium), 2026-05-19: Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06,…
CVE-2026-31909 - CVSS 7.5 (high), 2026-05-19: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are…
CVE-2026-31380 - CVSS 6.5 (medium), 2026-05-19: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This…
CVE-2026-31906 - CVSS 6.1 (medium), 2026-05-19: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before…
CVE-2026-31379 - CVSS 6.1 (medium), 2026-05-19: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path…
CVE-2026-31388 - CVSS 5.3 (medium), 2026-05-19: Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to…
CVE-2026-29226 - CVSS 7.3 (high), 2026-05-19: Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are…
CVE-2026-29220 - CVSS 6.5 (medium), 2026-05-19: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before…
CVE-2026-29207 - CVSS 6.5 (medium), 2026-05-19: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users…
CVE-2025-61623 - CVSS 6.5 (medium), 2025-11-12: Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version…
CVE-2025-59118 - CVSS 7.3 (high), 2025-11-12: Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to…
CVE-2025-54466 - CVSS 9.8 (critical), 2025-08-15: Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache…
CVE-2025-30676 - CVSS 6.1 (medium), 2025-04-01: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19.…
CVE-2025-26865 - CVSS 3.5 (low), 2025-03-10: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before…
CVE-2024-47208 - CVSS 9.8 (critical), 2024-11-18: Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz:…
CVE-2024-48962 - CVSS 8.9 (high), 2024-11-18: Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template…
CVE-2024-45507 - CVSS 9.8 (critical), 2024-09-04: Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz:…
CVE-2024-45195 - CVSS 9.8 (critical), 2024-09-04: Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to…
CVE-2024-38856 - CVSS 9.8 (critical), 2024-08-05: Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version…
CVE-2024-36104 - CVSS 9.1 (critical), 2024-06-04: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before…
CVE-2024-32113 - CVSS 9.8 (critical), 2024-05-08: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.…
CVE-2024-25065 - CVSS 9.1 (critical), 2024-02-29: Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
CVE-2024-23946 - CVSS 5.3 (medium), 2024-02-29: Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
CVE-2023-51467 - CVSS 9.8 (critical), 2023-12-26: The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
CVE-2023-50968 - CVSS 7.5 (high), 2023-12-26: Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri…
CVE-2023-49070 - CVSS 9.8 (critical), 2023-12-05: Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are…
CVE-2023-46819 - CVSS 5.3 (medium), 2023-11-07: Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are…
CVE-2022-47501 - CVSS 7.5 (high), 2023-04-14: Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue…
CVE-2022-25371 - CVSS 9.8 (critical), 2022-09-02: Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt…
CVE-2022-29158 - CVSS 7.5 (high), 2022-09-02: Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external,…
CVE-2022-25370 - CVSS 5.4 (medium), 2022-09-02: Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and…
CVE-2022-29063 - CVSS 9.8 (critical), 2022-09-02: The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by…
CVE-2022-25813 - CVSS 7.5 (high), 2022-09-02: In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message…
CVE-2021-25958 - CVSS 7.5 (high), 2021-08-30: In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info…
CVE-2021-37608 - CVSS 9.8 (critical), 2021-08-18: Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz…
CVE-2021-30128 - CVSS 9.8 (critical), 2021-04-27: Apache OFBiz has unsafe deserialization prior to 17.12.07 version
CVE-2021-29200 - CVSS 9.8 (critical), 2021-04-27: Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack
CVE-2021-26295 - CVSS 9.8 (critical), 2021-03-22: Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
CVE-2020-9496 - CVSS 6.1 (medium), 2020-07-15: XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
CVE-2020-13923 - CVSS 5.3 (medium), 2020-07-15: IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04
CVE-2019-0235 - CVSS 8.8 (high), 2020-04-30: Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.
CVE-2019-12425 - CVSS 7.5 (high), 2020-04-30: Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host
CVE-2020-1943 - CVSS 6.1 (medium), 2020-04-01: Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
CVE-2019-12426 - CVSS 5.3 (medium), 2020-02-06: an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06
CVE-2011-3600 - CVSS 7.5 (high), 2019-11-26: The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable…
CVE-2019-10073 - CVSS 6.1 (medium), 2019-09-11: The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade…
CVE-2019-10074 - CVSS 9.8 (critical), 2019-09-11: An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the…
CVE-2019-0189 - CVSS 9.8 (critical), 2019-09-11: The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java…
CVE-2018-17200 - CVSS 9.8 (critical), 2019-09-11: The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService…
CVE-2018-8033 - CVSS 7.5 (high), 2018-12-13: In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the…
CVE-2017-15714 - CVSS 9.8 (critical), 2018-01-04: The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through…
CVE-2012-1622 - CVSS 9.8 (critical), 2017-10-26: Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2016-6800 - CVSS 6.1 (medium), 2017-08-30: The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific…
CVE-2016-4462 - CVSS 8.8 (high), 2017-08-30: By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are…
CVE-2016-2170 - CVSS 9.8 (critical), 2016-04-12: Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object,…
CVE-2015-3268 - CVSS 6.1 (medium), 2016-04-12: Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x…
CVE-2014-0232 - CVSS 4.3 (medium), 2014-08-22: Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01…
CVE-2012-1621 - CVSS 4.3 (medium), 2014-06-19: Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject…
CVE-2013-0177 - CVSS 3.5 (low), 2014-01-30: Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before…
CVE-2013-2250 - CVSS 10 (critical), 2013-08-15: Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary…
CVE-2013-2137 - CVSS 4.3 (medium), 2013-08-15: Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through…
CVE-2012-3506 - CVSS 10 (critical), 2012-10-25: Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
CVE-2010-0432 - CVSS 4.3 (medium), 2010-04-15: Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and…
CVE-2006-6588 - CVSS 7.5 (high), 2006-12-15: The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) contentTypeId, and…
CVE-2006-6587 - CVSS 6.8 (medium), 2006-12-15: Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote…
CVE-2006-6589 - CVSS 6.8 (medium), 2006-12-15: Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9.3 allows remote…