Login Request a demo
Critical severity · published Aug 15, 2025
CVE-2025-54466
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin
9.8
CVSS
26.5%
EPSS
No
On KEV
Description
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)26.5% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
OFBiz · Apache
before 24.09.02 · source: NVD
Affected product
OF
OFBiz
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54466
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54466
Patch
https://issues.apache.org/jira/browse/OFBIZ-13276
Mailing List
https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915
Product
https://ofbiz.apache.org/download.html
Release Notes
https://ofbiz.apache.org/release-notes-24.09.02.html
Vendor Advisory
https://ofbiz.apache.org/security.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/08/05/1
More from OFBiz
9.8
CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
9.8
CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
7.5
CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
9.8
CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
9.8
CVE-2024-47208
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz