OF
ERP
OFBiz
On CISA KEVExploited in the wild
76
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 24High 19Medium 22Low 1
Watch
Add OFBiz to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45195 In wildKEV | 7.5 | Sep 4 | Apache OFBiz: Confused controller-view authorization logic (forced browsing) Affected: before 18.12.16 |
| CVE-2026-47342 | 8.8 | Jun 10 | Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass Affected: before 24.09.07 |
| CVE-2026-50223 | 8.8 | Jun 10 | Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution Affected: before 24.09.07 |
| CVE-2026-46586 | 8.8 | May 19 | Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution Affected: before 24.09.06 |
| CVE-2024-48962 | 8.8 | Nov 18 | Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability… Affected: before 18.12.17 |
| CVE-2019-0235 | 8.8 | Apr 30 | Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks Affected: 17.12.01 |
| CVE-2016-4462 | 8.8 | Aug 30 | By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a… Affected: 11.04; 11.04.01; 11.04.02; 11.04.03; 11.04.04; 11.04.05; +12 more |
| CVE-2026-31910 | 7.5 | May 19 | Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access Affected: before 24.09.06 |
| CVE-2026-31909 | 7.5 | May 19 | Apache OFBiz: Unauthenticated Shipment Label Image Disclosure Affected: before 24.09.06 |
| CVE-2023-50968 | 7.5 | Dec 26 | Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations Affected: before 18.12.11 |
| CVE-2022-47501 | 7.5 | Apr 14 | Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin Affected: before 18.12.07 |
| CVE-2022-29158 | 7.5 | Sep 2 | Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users Affected: before 18.12.06 |
| CVE-2022-25813 | 7.5 | Sep 2 | In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from… Affected: before 18.12.06 |
| CVE-2021-25958 | 7.5 | Aug 30 | In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the… Affected: 17.12.01 before 17.12.08 |
| CVE-2019-12425 | 7.5 | Apr 30 | Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host Affected: 17.12.01 |
| CVE-2011-3600 | 7.5 | Nov 26 | The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that… Affected: 16.11.01 through 16.11.04 |
| CVE-2018-8033 | 7.5 | Dec 13 | In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the… Affected: 16.11.01 through 16.11.04 |
| CVE-2026-29226 | 7.3 | May 19 | Apache OFBiz: Low-Privilege SSRF in Content Component Affected: before 24.09.06 |
| CVE-2025-59118 | 7.3 | Nov 12 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz Affected: before 24.09.03 |
Showing 19