Vigie VulnDBEuropean-hosted Vulnerability DB

Apache Software Foundation Apache OFBiz

51 published vulnerabilities name this product.

As the CNAs write it in their CVE records (vendor and product); the versions are theirs.

CVEVulnerable versionsTitleSeverityPublishedEPSSExploitation
CVE-2026-47342< 24.09.07Apache OFBiz: Privilege Escalation via updateOrRemove Authorization BypassHIGH 8.80.4 %
CVE-2026-50223< 24.09.07Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code ExecutionHIGH 8.80.7 %
CVE-2026-46586< 24.09.06Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code ExecutionHIGH 8.80.7 %
CVE-2026-45434< 24.09.06Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCECRITICAL 9.821 %
CVE-2026-45187< 24.09.06Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System JobsMEDIUM 6.50.5 %
CVE-2026-41919< 24.09.06Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN ConstructionCRITICAL 9.10.5 %
CVE-2026-35086< 24.09.06Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email servicesMEDIUM 6.50.5 %
CVE-2026-31986< 24.09.06Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template InjectionCRITICAL 9.10.4 %
CVE-2026-31910< 24.09.06Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File AccessHIGH 7.50.5 %
CVE-2026-31909< 24.09.06Apache OFBiz: Unauthenticated Shipment Label Image DisclosureHIGH 7.50.5 %
CVE-2026-31906< 24.09.06Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog ParametersMEDIUM 6.10.4 %
CVE-2026-31388< 24.09.06Apache OFBiz: Cross-Tenant Data Exposure via Program Export FeatureMEDIUM 5.30.4 %
CVE-2026-31387< 24.09.06Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account ImpersonationMEDIUM 5.30.5 %
CVE-2026-31380< 24.09.06Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization BypassMEDIUM 6.50.5 %
CVE-2026-31379< 24.09.06Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog ManagerMEDIUM 6.10.6 %
CVE-2026-31378< 24.09.06Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code ExecutionMEDIUM 6.50.6 %
CVE-2026-29226< 24.09.06Apache OFBiz: Low-Privilege SSRF in Content ComponentHIGH 7.30.5 %
CVE-2026-29207< 24.09.06Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content ComponentMEDIUM 6.50.5 %
CVE-2026-29220< 24.09.06Apache OFBiz: Low-Privilege LFI in Content ComponentMEDIUM 6.50.7 %
CVE-2025-61623< 24.09.03Apache OFBiz: Reflected Cross-site ScriptingMEDIUM 6.50.8 %
CVE-2025-59118< 24.09.03Apache OFBiz: Critical Remote Command Execution via Unrestricted File UploadHIGH 7.31.7 %
CVE-2025-54466< 24.09.02Apache OFBiz: RCE Vulnerability in scrum pluginCRITICAL 9.827 %
CVE-2025-30676< 18.12.19Apache OFBiz: Stored XSS VulnerabilityMEDIUM 6.168 %
CVE-2025-2686518.12.17 – < 18.12.18Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCELOW 3.50.7 %
CVE-2024-47208< 18.12.17Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCECRITICAL 9.81.6 %
CVE-2024-48962< 18.12.17Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)HIGH 8.90.6 %
CVE-2024-45195< 18.12.16Apache OFBiz: Confused controller-view authorization logic (forced browsing)CRITICAL 9.8100 %KEV
CVE-2024-45507< 18.12.16Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCECRITICAL 9.896 %
CVE-2024-38856≤ 18.12.14Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeCRITICAL 9.899 %KEV
CVE-2024-36104< 18.12.14Apache OFBiz: Path traversal leading to a RCECRITICAL 9.188 %
CVE-2024-32113< 18.12.13Apache OFBiz: Path traversal leading to RCECRITICAL 9.8100 %KEV
CVE-2024-23946< 18.12.12Apache OFBiz: Path traversal or file inclusionMEDIUM 5.33.1 %
CVE-2024-25065< 18.12.12Apache OFBiz: Path traversal allowing authentication bypass.CRITICAL 9.148 %
CVE-2023-51467< 18.12.11Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerabilityCRITICAL 9.896 %
CVE-2023-50968≤ 18.12.10Apache OFBiz: Arbitrary file properties reading and SSRF attackHIGH 7.563 %
CVE-2023-49070< 18.12.10Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentCRITICAL 9.895 %
CVE-2023-46819< 18.12.09Apache OFBiz: Execution of Solr plugin queries without authenticationMEDIUM 5.31.8 %
CVE-2022-4750118.12.06 – < 18.12.07Apache OFBiz: Arbitrary file reading vulnerabilityHIGH 7.510 %
CVE-2022-29158Apache OFBiz – 18.12.05Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBizHIGH 7.52.2 %
CVE-2022-29063Apache OFBiz – 18.12.05Java Deserialization via RMI Connection from the Solr plugin of Apache OFBizCRITICAL 9.85.1 %
CVE-2022-25813Apache OFBiz – 18.12.05Server-Side Template Injection affecting the ecommerce plugin of Apache OFBizHIGH 7.567 %
CVE-2022-25371Apache OFBiz – 18.12.05Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizCRITICAL 9.85.4 %
CVE-2022-25370Apache OFBiz – 18.12.05Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBizMEDIUM 5.42.8 %
CVE-2021-37608unspecified – 17.12.07Arbitrary file upload vulnerability in OFBizCRITICAL 9.86.0 %
CVE-2021-30128Apache OFBiz – < 17.12.07Unsafe deserialization in Apache OFBizCRITICAL 9.881 %
CVE-2021-29200Apache OFBiz – < 17.12.07RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMICRITICAL 9.855 %
CVE-2021-26295Apache OFBiz 17.12.01 to 17.12.05RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMICRITICAL 9.898 %
CVE-2018-8033Apache OFBiz 16.11.01 to 16.11.04In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP servHIGH 7.526 %
CVE-2017-1571416.11.01 to 16.11.03The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing tCRITICAL 9.83.3 %
CVE-2016-680013.07.* ; 12.04.* ; 11.04.*The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are relMEDIUM 6.13.5 %
CVE-2016-446213.07.* ; 12.04.* ; 11.04.*By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template EnginHIGH 8.83.8 %