# Apache Software Foundation Apache OFBiz.

Every CVE that names Apache Software Foundation Apache OFBiz among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager](https://agentprime.io/advisories/CVE-2026-31379.md)
  `CVE-2026-31379` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.1 Medium · Not analysed yet · Published 19 May 2026 · Tags: Path traversal, Cross-site scripting (XSS), Code injection
- [Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-31378.md)
  `CVE-2026-31378` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: CWE-20
- [Apache OFBiz: Low-Privilege SSRF in Content Component](https://agentprime.io/advisories/CVE-2026-29226.md)
  `CVE-2026-29226` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.3 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component](https://agentprime.io/advisories/CVE-2026-29207.md)
  `CVE-2026-29207` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Code injection
- [Apache OFBiz: Low-Privilege LFI in Content Component](https://agentprime.io/advisories/CVE-2026-29220.md)
  `CVE-2026-29220` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Path traversal
- [Apache OFBiz: Reflected Cross-site Scripting](https://agentprime.io/advisories/CVE-2025-61623.md)
  `CVE-2025-61623` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.5 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload](https://agentprime.io/advisories/CVE-2025-59118.md)
  `CVE-2025-59118` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.3 High · Not analysed yet · Published 12 Nov 2025 · Tags: Unrestricted file upload
- [Apache OFBiz: RCE Vulnerability in scrum plugin](https://agentprime.io/advisories/CVE-2025-54466.md)
  `CVE-2025-54466` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.3 Medium · EPSS 0.28 · Not analysed yet · Published 15 Aug 2025 · Tags: Code injection
- [Apache OFBiz: Stored XSS Vulnerability](https://agentprime.io/advisories/CVE-2025-30676.md)
  `CVE-2025-30676` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.1 Medium · EPSS 0.68 · Not analysed yet · Published 1 Apr 2025 · Tags: Cross-site scripting (XSS)
- [Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE](https://agentprime.io/advisories/CVE-2025-26865.md)
  `CVE-2025-26865` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 3.5 Low · Not analysed yet · Published 10 Mar 2025 · Tags: Code injection
- [Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE](https://agentprime.io/advisories/CVE-2024-47208.md)
  `CVE-2024-47208` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2024 · Tags: Code injection, Server-side request forgery (SSRF)
- [Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)](https://agentprime.io/advisories/CVE-2024-48962.md)
  `CVE-2024-48962` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.9 High · Not analysed yet · Published 18 Nov 2024 · Tags: Code injection, Cross-site request forgery (CSRF)
- [Apache OFBiz: Confused controller-view authorization logic (forced browsing)](https://agentprime.io/advisories/CVE-2024-45195.md)
  `CVE-2024-45195` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 4 Sept 2024 · Tags: Broken access control
- [Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE](https://agentprime.io/advisories/CVE-2024-45507.md)
  `CVE-2024-45507` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.96 · Not analysed yet · Published 4 Sept 2024 · Tags: Code injection, Server-side request forgery (SSRF)
- [Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code](https://agentprime.io/advisories/CVE-2024-38856.md)
  `CVE-2024-38856` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.1 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 5 Aug 2024 · Tags: Broken access control
- [Apache OFBiz: Path traversal leading to a RCE](https://agentprime.io/advisories/CVE-2024-36104.md)
  `CVE-2024-36104` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.88 · Not analysed yet · Published 4 Jun 2024 · Tags: Path traversal
- [Apache OFBiz: Path traversal leading to RCE](https://agentprime.io/advisories/CVE-2024-32113.md)
  `CVE-2024-32113` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.1 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 8 May 2024 · Tags: Path traversal
- [Apache OFBiz: Path traversal or file inclusion](https://agentprime.io/advisories/CVE-2024-23946.md)
  `CVE-2024-23946` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 5.3 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: Path traversal, Unrestricted file upload
- [Apache OFBiz: Path traversal allowing authentication bypass.](https://agentprime.io/advisories/CVE-2024-25065.md)
  `CVE-2024-25065` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.48 · Not analysed yet · Published 28 Feb 2024 · Tags: Path traversal
- [Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2023-51467.md)
  `CVE-2023-51467` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · EPSS 0.96 · Not analysed yet · Published 26 Dec 2023
- [Apache OFBiz: Arbitrary file properties reading and SSRF attack](https://agentprime.io/advisories/CVE-2023-50968.md)
  `CVE-2023-50968` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · EPSS 0.63 · Not analysed yet · Published 26 Dec 2023 · Tags: Information disclosure, Server-side request forgery (SSRF)
- [Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present](https://agentprime.io/advisories/CVE-2023-49070.md)
  `CVE-2023-49070` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · EPSS 0.95 · Not analysed yet · Published 5 Dec 2023 · Tags: Code injection
- [Apache OFBiz: Execution of Solr plugin queries without authentication](https://agentprime.io/advisories/CVE-2023-46819.md)
  `CVE-2023-46819` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 5.3 Medium · Not analysed yet · Published 7 Nov 2023 · Tags: Authentication bypass
- [Apache OFBiz: Arbitrary file reading vulnerability](https://agentprime.io/advisories/CVE-2022-47501.md)
  `CVE-2022-47501` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 14 Apr 2023 · Tags: Path traversal
- [Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz](https://agentprime.io/advisories/CVE-2022-29158.md)
  `CVE-2022-29158` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 2 Sept 2022 · Tags: Denial of service
- [Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz](https://agentprime.io/advisories/CVE-2022-29063.md)
  `CVE-2022-29063` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 2 Sept 2022 · Tags: Insecure deserialization
- [Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz](https://agentprime.io/advisories/CVE-2022-25813.md)
  `CVE-2022-25813` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · EPSS 0.67 · Not analysed yet · Published 2 Sept 2022 · Tags: Code injection
- [Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz](https://agentprime.io/advisories/CVE-2022-25371.md)
  `CVE-2022-25371` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 2 Sept 2022 · Tags: Path traversal
- [Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz](https://agentprime.io/advisories/CVE-2022-25370.md)
  `CVE-2022-25370` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 2 Sept 2022 · Tags: Cross-site scripting (XSS)
- [Arbitrary file upload vulnerability in OFBiz](https://agentprime.io/advisories/CVE-2021-37608.md)
  `CVE-2021-37608` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 18 Aug 2021 · Tags: Unrestricted file upload
- [Unsafe deserialization in Apache OFBiz](https://agentprime.io/advisories/CVE-2021-30128.md)
  `CVE-2021-30128` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · EPSS 0.81 · Not analysed yet · Published 27 Apr 2021
- [RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI](https://agentprime.io/advisories/CVE-2021-29200.md)
  `CVE-2021-29200` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · EPSS 0.55 · Not analysed yet · Published 27 Apr 2021
- [RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI](https://agentprime.io/advisories/CVE-2021-26295.md)
  `CVE-2021-26295` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · EPSS 0.98 · Not analysed yet · Published 22 Mar 2021
- [Apache Software Foundation Apache OFBiz: In Apache OFBiz 16.11.01 to 16.11.04…](https://agentprime.io/advisories/CVE-2018-8033.md)
  `CVE-2018-8033` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · EPSS 0.26 · Not analysed yet · Published 13 Dec 2018
- [The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed.](https://agentprime.io/advisories/CVE-2017-15714.md)
  `CVE-2017-15714` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 4 Jan 2018
- [The default configuration of the Apache OFBiz framework offers a blog functionality.](https://agentprime.io/advisories/CVE-2016-6800.md)
  `CVE-2016-6800` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 30 Aug 2017
- [Apache Software Foundation Apache OFBiz: By manipulating the URL parameter externalLoginKey, a malicious…](https://agentprime.io/advisories/CVE-2016-4462.md)
  `CVE-2016-4462` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 30 Aug 2017

Newest: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-ofbiz.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-ofbiz&cursor=WyIyMDI2LTA1LTE5VDA5OjI0OjM5LjEzOTAwMFoiLCJDVkUtMjAyNi0zMTM4MCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-ofbiz/?cursor=WyIyMDI2LTA1LTE5VDA5OjI0OjM5LjEzOTAwMFoiLCJDVkUtMjAyNi0zMTM4MCJd>. Everything for agents: <https://agentprime.io/llms.txt>.