Advisories · Technology

Apache Software Foundation Apache OFBiz.

Every CVE that names Apache Software Foundation Apache OFBiz among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-31379 CVE record

CVSS 6.1 Medium

Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager
- Apache Software Foundation Apache OFBiz
- Path traversal
- Cross-site scripting (XSS)
Not analysed yet 19 May 2026
CVE-2026-31378 CVE record

CVSS 6.5 Medium

Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution
- Apache Software Foundation Apache OFBiz
- CWE-20
Not analysed yet 19 May 2026
CVE-2026-29226 CVE record

CVSS 7.3 High

Apache OFBiz: Low-Privilege SSRF in Content Component
- Apache Software Foundation Apache OFBiz
- Server-side request forgery (SSRF)
Not analysed yet 19 May 2026
CVE-2026-29207 CVE record

CVSS 6.5 Medium

Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 19 May 2026
CVE-2026-29220 CVE record

CVSS 6.5 Medium

Apache OFBiz: Low-Privilege LFI in Content Component
- Apache Software Foundation Apache OFBiz
- Path traversal
Not analysed yet 19 May 2026
CVE-2025-61623 CVE record

CVSS 6.5 Medium

Apache OFBiz: Reflected Cross-site Scripting
- Apache Software Foundation Apache OFBiz
- Cross-site scripting (XSS)
Not analysed yet 12 Nov 2025
CVE-2025-59118 CVE record

CVSS 7.3 High

Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload
- Apache Software Foundation Apache OFBiz
- Unrestricted file upload
Not analysed yet 12 Nov 2025
CVE-2025-54466 CVE record

CVSS 6.3 Medium

Apache OFBiz: RCE Vulnerability in scrum plugin
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 15 Aug 2025
CVE-2025-30676 CVE record

CVSS 6.1 Medium

Apache OFBiz: Stored XSS Vulnerability
- Apache Software Foundation Apache OFBiz
- Cross-site scripting (XSS)
Not analysed yet 1 Apr 2025
CVE-2025-26865 CVE record

CVSS 3.5 Low

Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 10 Mar 2025
CVE-2024-47208 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE
- Apache Software Foundation Apache OFBiz
- Code injection
- Server-side request forgery (SSRF)
Not analysed yet 18 Nov 2024
CVE-2024-48962 CVE record

CVSS 8.9 High

Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)
- Apache Software Foundation Apache OFBiz
- Code injection
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2024
CVE-2024-45195 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Apache OFBiz: Confused controller-view authorization logic (forced browsing)
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 4 Sept 2024
CVE-2024-45507 CVE record

CVSS 8.8 HighCritical · CVSS 7+ and EPSS

Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE
- Apache Software Foundation Apache OFBiz
- Code injection
- Server-side request forgery (SSRF)
Not analysed yet 4 Sept 2024
CVE-2024-38856 CVE record

CVSS 8.1 HighCritical · KEV, CVSS 7+ and EPSSKEV

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
- Apache Software Foundation Apache OFBiz
- Broken access control
Not analysed yet 5 Aug 2024
CVE-2024-36104 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Apache OFBiz: Path traversal leading to a RCE
- Apache Software Foundation Apache OFBiz
- Path traversal
Not analysed yet 4 Jun 2024
CVE-2024-32113 CVE record

CVSS 9.1 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Apache OFBiz: Path traversal leading to RCE
- Apache Software Foundation Apache OFBiz
- Path traversal
Not analysed yet 8 May 2024
CVE-2024-23946 CVE record

CVSS 5.3 Medium

Apache OFBiz: Path traversal or file inclusion
- Apache Software Foundation Apache OFBiz
- Path traversal
- Unrestricted file upload
Not analysed yet 28 Feb 2024
CVE-2024-25065 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Apache OFBiz: Path traversal allowing authentication bypass.
- Apache Software Foundation Apache OFBiz
- Path traversal
Not analysed yet 28 Feb 2024
CVE-2023-51467 CVE record

Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
- Apache Software Foundation Apache OFBiz
Not analysed yet 26 Dec 2023
CVE-2023-50968 CVE record

Apache OFBiz: Arbitrary file properties reading and SSRF attack
- Apache Software Foundation Apache OFBiz
- Information disclosure
- Server-side request forgery (SSRF)
Not analysed yet 26 Dec 2023
CVE-2023-49070 CVE record

Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 5 Dec 2023
CVE-2023-46819 CVE record

CVSS 5.3 Medium

Apache OFBiz: Execution of Solr plugin queries without authentication
- Apache Software Foundation Apache OFBiz
- Authentication bypass
Not analysed yet 7 Nov 2023
CVE-2022-47501 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Apache OFBiz: Arbitrary file reading vulnerability
- Apache Software Foundation Apache OFBiz
- Path traversal
Not analysed yet 14 Apr 2023
CVE-2022-29158 CVE record

Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz
- Apache Software Foundation Apache OFBiz
- Denial of service
Not analysed yet 2 Sept 2022
CVE-2022-29063 CVE record

Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz
- Apache Software Foundation Apache OFBiz
- Insecure deserialization
Not analysed yet 2 Sept 2022
CVE-2022-25813 CVE record

Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz
- Apache Software Foundation Apache OFBiz
- Code injection
Not analysed yet 2 Sept 2022
CVE-2022-25371 CVE record

Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz
- Apache Software Foundation Apache OFBiz
- Path traversal
Not analysed yet 2 Sept 2022
CVE-2022-25370 CVE record

Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBiz
- Apache Software Foundation Apache OFBiz
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2022
CVE-2021-37608 CVE record

Arbitrary file upload vulnerability in OFBiz
- Apache Software Foundation Apache OFBiz
- Unrestricted file upload
Not analysed yet 18 Aug 2021
CVE-2021-30128 CVE record

Unsafe deserialization in Apache OFBiz
- Apache Software Foundation Apache OFBiz
Not analysed yet 27 Apr 2021
CVE-2021-29200 CVE record

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
- Apache Software Foundation Apache OFBiz
Not analysed yet 27 Apr 2021
CVE-2021-26295 CVE record

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
- Apache Software Foundation Apache OFBiz
Not analysed yet 22 Mar 2021
CVE-2018-8033 CVE record

Apache Software Foundation Apache OFBiz: In Apache OFBiz 16.11.01 to 16.11.04…
- Apache Software Foundation Apache OFBiz
Not analysed yet 13 Dec 2018
CVE-2017-15714 CVE record

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed.
- Apache Software Foundation Apache OFBiz
Not analysed yet 4 Jan 2018
CVE-2016-6800 CVE record

The default configuration of the Apache OFBiz framework offers a blog functionality.
- Apache Software Foundation Apache OFBiz
Not analysed yet 30 Aug 2017
CVE-2016-4462 CVE record

Apache Software Foundation Apache OFBiz: By manipulating the URL parameter externalLoginKey, a malicious…
- Apache Software Foundation Apache OFBiz
Not analysed yet 30 Aug 2017