Apache OFBiz vulnerabilities
27 known CVE vulnerabilities in Apache OFBiz, translated and rated.
- CVE-2016-4462High
CVE-2016-4462 allows a malicious, logged-in user to manipulate the URL parameter externalLoginKey, potentially leading to remote code execution via a specially crafted Freemarker template.
- CVE-2026-45434Critical
CVE-2026-45434 in Apache OFBiz has a flaw in password-change logic that can lead to remote code execution. This issue affects versions before 24.09.06.
- CVE-2026-41919Critical
CVE-2026-41919 describes an improper neutralization of special elements used in LDAP queries, leading to LDAP Injection vulnerability in Apache OFBiz.
- CVE-2026-31986Critical
Use of hard-coded cryptographic key vulnerability in Apache OFBiz. This issue affects versions before 24.09.06.
- CVE-2024-45195HighActively exploited
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz before 18.12.16.
- CVE-2024-38856CriticalActively exploited
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
- CVE-2024-32113CriticalActively exploited
In Apache OFBiz before 18.12.13, a path traversal vulnerability exists due to improper limitation of a pathname to a restricted directory. Attackers can access files outside the intended directory.
- CVE-2012-1622Critical
Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
- CVE-2016-2170Critical
Apache OFBiz versions 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
- CVE-2026-50223High
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz before 24.09.07.
- CVE-2026-47342High
Apache OFBiz before version 24.09.07 contains a privilege escalation vulnerability that allows a low-privileged authenticated user to obtain higher privileges.
- CVE-2026-46586High
Apache OFBiz has a vulnerability related to improper control of code generation and improper neutralization of directives in dynamically evaluated code. This issue affects versions before 24.09.06.
- CVE-2026-45187Medium
Apache OFBiz Webtools before 24.09.06 contains an Improper Authorization vulnerability.
- CVE-2026-35086Medium
Apache OFBiz before 24.09.06 contains a Code Injection vulnerability in email services.
- CVE-2026-31910High
The Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz before version 24.09.06 allows an attacker to use the server to send requests to internal or external resources.
- CVE-2026-31909High
The CVE-2026-31909 vulnerability in Apache OFBiz involves exposure of sensitive information to unauthorized actors. This issue affects versions before 24.09.06.
- CVE-2026-31906Medium
A Cross-site Scripting (XSS) vulnerability in Apache OFBiz results from improper neutralization of input during web page generation. The issue affects versions before 24.09.06.
- CVE-2026-31388Medium
Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06.
- CVE-2026-31387Medium
An improper authentication vulnerability in Apache OFBiz allows bypassing authorization mechanisms. The issue affects versions before 24.09.06.
- CVE-2026-31380Medium
Apache OFBiz before 24.09.06 contains an Expression Language Injection vulnerability due to improper neutralization of special elements.
- CVE-2026-31379Medium
Apache OFBiz before 24.09.06 contains Cross-site Scripting (XSS), Path Traversal, and Code Injection vulnerabilities due to improper input neutralization and pathname restrictions.
- CVE-2026-31378Medium
Apache OFBiz before 24.09.06 contains an Improper Input Validation vulnerability.
- CVE-2026-29226High
The SSRF vulnerability in Apache OFBiz, occurring in Content component operations, allows an attacker to send malicious requests to the server. This issue affects versions of Apache OFBiz before 24.09.06.
- CVE-2026-29220Medium
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
- CVE-2026-29207Medium
Apache OFBiz before 24.09.06 contains a Template Engine Injection vulnerability due to improper neutralization of special elements. In version 24.09.06, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported, and the "Ecommerce Customer" security group no longer includes content management grants.
- CVE-2025-61623Medium
A reflected cross-site scripting vulnerability exists in Apache OFBiz. This issue affects versions before 24.09.03.
- CVE-2025-59118High
An unrestricted upload of a file with a dangerous type vulnerability exists in Apache OFBiz. The issue affects versions before 24.09.03 and may allow uploading a malicious file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS