Where
-Infinity
0

Trending

Last week
Last month
Last year

Apache OFBizApache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution

Risk 83
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution.

This issue affects Apache OFBiz: before 24.09.07.

Users are recommended to upgrade to version 24.09.07, which fixes the issue.

First published (updated )
CVE-2026-50223

Apache OFBizApache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass

Risk 83
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges

This issue affects Apache OFBiz: before 24.09.07.

Users are recommended to upgrade to version 24.09.07, which fixes the issue.

First published (updated )
CVE-2026-47342

oss-secCVE-2026-50223: Apache OFBiz: Datasource Low-Privileged Authenticated FeMarker Template Injection Leads to mote Code Execution

Severity: moderate

Affected versions:

- Apache OFBiz before 24.09.07

Description:

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution.

This issue affects Apache OFBiz: before 24.09.07.

Users are recommended to upgrade to version 24.09.07, which fixes the issue.

Credit:

yi (reporter) Jongyeon Lee (reporter)

References:

https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-50223

First published (updated )
https://seclists.org/oss-sec/2026/q2/874

Apache OFBizApache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution

Risk 83
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-46586

Apache OFBizApache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE

Risk 90
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-45434

Apache OFBizApache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs

Risk 42
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Authorization vulnerability in Apache OFBiz Webtools.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-45187

Apache Apache OFBizApache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

Risk 70
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-41919

Apache Apache OFBizApache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services

Risk 42
Severity
6.5
Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-35086

Apache Apache OFBizApache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection

Risk 70
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31986

Apache OFBizApache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access

Risk 46
Severity
7.5
SSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31910

Apache Apache OFBizApache OFBiz: Unauthenticated Shipment Label Image Disclosure

Risk 46
Severity
7.5
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31909

Apache OFBizApache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters

Risk 40
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31906

Apache OFBizApache OFBiz: Cross-Tenant Data Exposure via Program Export Feature

Risk 28
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31388

Apache Apache OFBizApache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation

Risk 28
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Improper Authentication vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31387

Apache Apache OFBizApache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass

Risk 42
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31380

Apache OFBizApache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager

Risk 40
Severity
6.1
XSS, Path Traversal, Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31379

Apache Apache OFBizApache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution

Risk 42
Severity
6.5
Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Input Validation vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31378

Apache OFBizApache OFBiz: Low-Privilege SSRF in Content Component

Risk 51
Severity
7.3
SSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-29226

Apache OFBizApache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component

Risk 40
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported.

Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.

First published (updated )
CVE-2026-29207

Apache OFBizApache OFBiz: Low-Privilege LFI in Content Component

Risk 40
Severity
6.5
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-29220

oss-secCVE-2026-41919: Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

Severity: moderate

Affected versions:

- Apache OFBiz before 24.09.06

Description:

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Credit:

zhaokaifei (China Telecom) (reporter)

References:

https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-41919

First published (updated )
https://seclists.org/oss-sec/2026/q2/599

oss-secCVE-2026-35086: Apache OFBiz: Authenticated mote Code Execution via Unsafe Template Expansion in email services

Severity: moderate

Affected versions:

- Apache OFBiz before 24.09.06

Description:

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Credit:

Hyunwoo Kim (@v4bel) (reporter)

References:

https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-35086

First published (updated )
https://seclists.org/oss-sec/2026/q2/598

oss-secCVE-2026-31388: Apache OFBiz: Cross-Tenant Data Exposuvia Program Export Featu

Severity: moderate

Affected versions:

- Apache OFBiz before 24.09.06

Description:

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Credit:

Krishna Uprit (reporter)

References:

https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-31388

First published (updated )
https://seclists.org/oss-sec/2026/q2/593

Apache OFBizApache OFBiz: RCE Vulnerability in scrum plugin

Risk 90
Severity
9.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.

This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used.

Even unauthenticated attackers can exploit this vulnerability.

Users are recommended to upgrade to version 24.09.02, which fixes the issue.

First published (updated )
CVE-2025-54466

Apache OFBizApache OFBiz: Stored XSS Vulnerability

Risk 28
Severity
6.1
EPSS
0.03%
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.19.

Users are recommended to upgrade to version 18.12.19, which fixes the issue.

First published (updated )
CVE-2025-30676

CVE-2025-30676: Apache OFBiz: Stod XSS Vulnerability

Severity: moderate

Affected versions:

- Apache OFBiz before 18.12.19

Description:

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.19.

Users are recommended to upgrade to version 18.12.19, which fixes the issue.

Credit:

Khaled Nassar (@mindpatch) (finder)

References:

https://ofbiz.apache.org/download.html https://ofbiz.apache.org/security.html https://issues.apache.org/jira/browse/OFBIZ-13219 https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-30676

First published (updated )
https://seclists.org/oss-sec/2025/q2/2

Apache OFBizApache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

Risk 19
Severity
3.5
EPSS
0.07%
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.

It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used.

In other words, if you use 18.12.17 you are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is.

In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.

First published (updated )
CVE-2025-26865

Apache OFBizApache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

Risk 90
Severity
9.8
SSRF, Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

First published (updated )
CVE-2024-47208

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203