Where
-Infinity
0

Trending

Last week
Last month
Last year

Apache OFBizApache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution

Risk 83
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution.

This issue affects Apache OFBiz: before 24.09.07.

Users are recommended to upgrade to version 24.09.07, which fixes the issue.

First published (updated )
CVE-2026-50223

Apache OFBizApache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass

Risk 83
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges

This issue affects Apache OFBiz: before 24.09.07.

Users are recommended to upgrade to version 24.09.07, which fixes the issue.

First published (updated )
CVE-2026-47342

Apache OFBizApache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

Risk 19
Severity
3.5
EPSS
0.07%
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.

It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used.

In other words, if you use 18.12.17 you are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is.

In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.

First published (updated )
CVE-2025-26865

Apache OFBizApache OFBiz Forced Browsing Vulnerability

Risk 99
Severity
9.8
Exploited
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.

1 / 2
Source: CISA
First published (updated )
CVE-2024-45195

Apache OFBizApache OFBiz Incorrect Authorization Vulnerability

Risk 99
Severity
9.8
Exploited
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.

1 / 2
Source: CISA
First published (updated )
CVE-2024-38856

Apache OFBizApache OFBiz Path Traversal Vulnerability

Risk 99
Severity
9.8
Exploited
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.

1 / 2
Source: CISA
First published (updated )
CVE-2024-32113

Apache OFBizArbitrary file upload vulnerability in OFBiz

Risk 86
Severity
9.8
Malicious File Upload
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz version 17.12.07 and prior versions. Upgrade to at least 17.12.08 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297.

First published (updated )
CVE-2021-37608

Apache OFBizXSS

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.

First published (updated )
CVE-2020-1943

oss-secCVE-2026-50223: Apache OFBiz: Datasource Low-Privileged Authenticated FeMarker Template Injection Leads to mote Code Execution

Severity: moderate

Affected versions:

- Apache OFBiz before 24.09.07

Description:

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution.

This issue affects Apache OFBiz: before 24.09.07.

Users are recommended to upgrade to version 24.09.07, which fixes the issue.

Credit:

yi (reporter) Jongyeon Lee (reporter)

References:

https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-50223

First published (updated )
https://seclists.org/oss-sec/2026/q2/874

Apache OFBizApache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution

Risk 83
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-46586

Apache OFBizApache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE

Risk 90
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-45434

Apache Apache OFBizApache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services

Risk 42
Severity
6.5
Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-35086

Apache OFBizApache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs

Risk 42
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Authorization vulnerability in Apache OFBiz Webtools.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-45187

Apache Apache OFBizApache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

Risk 70
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-41919

Apache Apache OFBizApache OFBiz: Unauthenticated Shipment Label Image Disclosure

Risk 46
Severity
7.5
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31909

Apache OFBizApache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access

Risk 46
Severity
7.5
SSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31910

Apache Apache OFBizApache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection

Risk 70
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31986

Apache OFBizApache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters

Risk 40
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31906

Apache Apache OFBizApache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution

Risk 42
Severity
6.5
Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Input Validation vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31378

Apache OFBizApache OFBiz: Cross-Tenant Data Exposure via Program Export Feature

Risk 28
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31388

Apache OFBizApache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager

Risk 40
Severity
6.1
XSS, Path Traversal, Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31379

Apache Apache OFBizApache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass

Risk 42
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31380

Apache Apache OFBizApache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation

Risk 28
Severity
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Improper Authentication vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-31387

Apache OFBizApache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component

Risk 40
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported.

Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.

First published (updated )
CVE-2026-29207

Apache OFBizApache OFBiz: Low-Privilege SSRF in Content Component

Risk 51
Severity
7.3
SSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-29226

Apache OFBizApache OFBiz: Low-Privilege LFI in Content Component

Risk 40
Severity
6.5
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

First published (updated )
CVE-2026-29220

oss-secCVE-2026-41919: Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

Severity: moderate

Affected versions:

- Apache OFBiz before 24.09.06

Description:

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Credit:

zhaokaifei (China Telecom) (reporter)

References:

https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-41919

First published (updated )
https://seclists.org/oss-sec/2026/q2/599

oss-secCVE-2026-35086: Apache OFBiz: Authenticated mote Code Execution via Unsafe Template Expansion in email services

Severity: moderate

Affected versions:

- Apache OFBiz before 24.09.06

Description:

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Credit:

Hyunwoo Kim (@v4bel) (reporter)

References:

https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-35086

First published (updated )
https://seclists.org/oss-sec/2026/q2/598

oss-secCVE-2026-31388: Apache OFBiz: Cross-Tenant Data Exposuvia Program Export Featu

Severity: moderate

Affected versions:

- Apache OFBiz before 24.09.06

Description:

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Credit:

Krishna Uprit (reporter)

References:

https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-31388

First published (updated )
https://seclists.org/oss-sec/2026/q2/593

Apache OFBizApache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Risk 56
Severity
8.9
EPSS
0.06%
Code Injection, CSRF
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Amber

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 18.12.17.

Users are recommended to upgrade to version 18.12.17, which fixes the issue.

First published (updated )
CVE-2024-48962

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203