OF
ERP
OFBiz
On CISA KEVExploited in the wild
76
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 24High 19Medium 22Low 1
Watch
Add OFBiz to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45187 | 6.5 | May 19 | Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs Affected: before 24.09.06 |
| CVE-2026-35086 | 6.5 | May 19 | Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services Affected: before 24.09.06 |
| CVE-2026-31380 | 6.5 | May 19 | Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass Affected: before 24.09.06 |
| CVE-2026-31378 | 6.5 | May 19 | Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution Affected: before 24.09.06 |
| CVE-2026-29207 | 6.5 | May 19 | Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component Affected: before 24.09.06 |
| CVE-2026-29220 | 6.5 | May 19 | Apache OFBiz: Low-Privilege LFI in Content Component Affected: before 24.09.06 |
| CVE-2025-61623 | 6.5 | Nov 12 | Reflected cross-site scripting vulnerability in Apache OFBiz Affected: before 24.09.03 |
| CVE-2026-31906 | 6.1 | May 19 | Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters Affected: before 24.09.06 |
| CVE-2026-31379 | 6.1 | May 19 | Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager Affected: before 24.09.06 |
| CVE-2025-30676 | 6.1 | Apr 1 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz Affected: before 18.12.19 |
| CVE-2020-9496 | 6.1 | Jul 15 | XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 Affected: 17.12.03 |
| CVE-2020-1943 | 6.1 | Apr 1 | Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07 Affected: 16.11.01 through 16.11.07 |
| CVE-2019-10073 | 6.1 | Sep 11 | The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks Affected: 16.11.01 through 16.11.05 |
| CVE-2016-6800 | 6.1 | Aug 30 | The default configuration of the Apache OFBiz framework offers a blog functionality Affected: 11.04; 11.04.01; 11.04.02; 11.04.03; 11.04.04; 11.04.05; +12 more |
| CVE-2015-3268 | 6.1 | Apr 12 | Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows… Affected: 12.04.01; 12.04.02; 12.04.03; 12.04.04; 12.04.05; 13.07.01; +1 more |
| CVE-2022-25370 | 5.4 | Sep 2 | Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports Affected: before 18.12.06 |
| CVE-2026-31388 | 5.3 | May 19 | Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature Affected: before 24.09.06 |
| CVE-2026-31387 | 5.3 | May 19 | Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation Affected: before 24.09.06 |
| CVE-2024-23946 | 5.3 | Feb 29 | Possible path traversal in Apache OFBiz allowing file inclusion Affected: before 18.12.12 |
| CVE-2023-46819 | 5.3 | Nov 7 | Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin Affected: before 18.12.09 |
| CVE-2020-13923 | 5.3 | Jul 15 | IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04 Affected: before 17.12.04 |
| CVE-2019-12426 | 5.3 | Feb 6 | an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06 Affected: 16.11.01 through 16.11.06 |
Showing 22