What’s Vulnerable › Products

Apache Software Foundation Apache OFBiz vulnerabilities

76 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 26 published in the last 12 months.

Check whether your Apache Software Foundation Apache OFBiz version is affected

Exploited Apache Software Foundation Apache OFBiz vulnerabilities

• CVE-2024-45195 — Apache OFBiz Forced Browsing Vulnerability
• CVE-2024-38856 — Apache OFBiz Incorrect Authorization Vulnerability
• CVE-2024-32113 — Apache OFBiz Path Traversal Vulnerability

Latest Apache Software Foundation Apache OFBiz vulnerabilities

• CVE-2026-50223 — Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution (CVSS 8.8)
• CVE-2026-47342 — Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass (CVSS 8.8)
• CVE-2026-46586 — Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution (CVSS 8.8)
• CVE-2026-45434 — Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE (CVSS 9.8)
• CVE-2026-45187 — Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs (CVSS 6.5)
• CVE-2026-41919 — Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction (CVSS 9.1)
• CVE-2026-35086 — Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services (CVSS 6.5)
• CVE-2026-31986 — Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection (CVSS 9.1)
• CVE-2026-31910 — Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access (CVSS 7.5)
• CVE-2026-31909 — Apache OFBiz: Unauthenticated Shipment Label Image Disclosure (CVSS 7.5)
• CVE-2026-31906 — Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters (CVSS 6.1)
• CVE-2026-31388 — Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature (CVSS 5.3)
• CVE-2026-31387 — Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation (CVSS 5.3)
• CVE-2026-31380 — Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass (CVSS 6.5)
• CVE-2026-31379 — Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager (CVSS 6.1)
• CVE-2026-31378 — Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution (CVSS 6.5)
• CVE-2026-29226 — Apache OFBiz: Low-Privilege SSRF in Content Component (CVSS 7.3)
• CVE-2026-29220 — Apache OFBiz: Low-Privilege LFI in Content Component (CVSS 6.5)
• CVE-2026-29207 — Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component (CVSS 6.5)
• CVE-2025-61623 — Apache OFBiz: Reflected Cross-site Scripting (CVSS 6.5)
• CVE-2025-59118 — Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload (CVSS 7.3)
• CVE-2025-54466 — Apache OFBiz: RCE Vulnerability in scrum plugin (CVSS 9.8)
• CVE-2025-30676 — Apache OFBiz: Stored XSS Vulnerability (CVSS 6.1)
• CVE-2025-26865 — Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE (CVSS 3.5)
• CVE-2024-48962 — Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE) (CVSS 8.8)