OF
ERP
OFBiz
On CISA KEVExploited in the wild
76
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 24High 19Medium 22Low 1
Watch
Add OFBiz to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-31906 | 6.1 | May 19 | Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters Affected: before 24.09.06 |
| CVE-2026-31379 | 6.1 | May 19 | Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager Affected: before 24.09.06 |
| CVE-2025-30676 | 6.1 | Apr 1 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz Affected: before 18.12.19 |
| CVE-2020-9496 | 6.1 | Jul 15 | XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 Affected: 17.12.03 |
| CVE-2020-1943 | 6.1 | Apr 1 | Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07 Affected: 16.11.01 through 16.11.07 |
| CVE-2019-10073 | 6.1 | Sep 11 | The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks Affected: 16.11.01 through 16.11.05 |
| CVE-2016-6800 | 6.1 | Aug 30 | The default configuration of the Apache OFBiz framework offers a blog functionality Affected: 11.04; 11.04.01; 11.04.02; 11.04.03; 11.04.04; 11.04.05; +12 more |
| CVE-2015-3268 | 6.1 | Apr 12 | Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows… Affected: 12.04.01; 12.04.02; 12.04.03; 12.04.04; 12.04.05; 13.07.01; +1 more |
| CVE-2022-25370 | 5.4 | Sep 2 | Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports Affected: before 18.12.06 |
| CVE-2026-31388 | 5.3 | May 19 | Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature Affected: before 24.09.06 |
| CVE-2026-31387 | 5.3 | May 19 | Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation Affected: before 24.09.06 |
| CVE-2024-23946 | 5.3 | Feb 29 | Possible path traversal in Apache OFBiz allowing file inclusion Affected: before 18.12.12 |
| CVE-2023-46819 | 5.3 | Nov 7 | Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin Affected: before 18.12.09 |
| CVE-2020-13923 | 5.3 | Jul 15 | IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04 Affected: before 17.12.04 |
| CVE-2019-12426 | 5.3 | Feb 6 | an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06 Affected: 16.11.01 through 16.11.06 |
| CVE-2025-26865 | 3.5 | Mar 10 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz Affected: 18.12.17 |
| CVE-2014-0232 | – | Aug 22 | Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow… Affected: 12.04.01; 12.04.02; 12.04.03; 11.04.01; 11.04.02; 11.04.03; +1 more |
| CVE-2012-1621 | – | Jun 19 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script… Affected: 10.04.01 |
| CVE-2013-0177 | – | Jan 30 | Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and… Affected: 09.04; 09.04.01; 10.04; 10.04.01; 10.04.02; 10.04.03; +2 more |
| CVE-2013-2250 | – | Aug 15 | Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression… Affected: 10.04.01; 10.04.02; 10.04.03; 10.04.04; 10.04.05; 11.04.01; +2 more |
| CVE-2013-2137 | – | Aug 15 | Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01… Affected: 10.04.01; 10.04.02; 10.04.03; 10.04.04; 10.04.05; 11.04.01; +2 more |
| CVE-2012-3506 | – | Oct 25 | Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors Affected: 10.04.01; 10.04.02 |
| CVE-2010-0432 | – | Apr 15 | Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow… Affected: through 09.04 |
| CVE-2006-6589 | – | Dec 15 | Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9.3 allows remote attackers to inject… Affected: All versions, or not specified |
| CVE-2006-6588 | – | Dec 15 | The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) contentTypeId, and certain other hidden… Affected: All versions, or not specified |
| CVE-2006-6587 | – | Dec 15 | Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject… Affected: All versions, or not specified |