Apache Ofbiz
76 CVEs affecting Apache Ofbiz. Latest disclosed: 2026-06-10. Critical: 24, High: 18.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-45434 | Critical | 9.8 | 2026-05-19 | Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before… |
CVE-2025-54466 | Critical | 9.8 | 2025-08-15 | Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBi… |
CVE-2024-47208 | Critical | 9.8 | 2024-11-18 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-45507 | Critical | 9.8 | 2024-09-04 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-38856 | Critical | 9.8 | 2024-08-05 | Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.1… |
CVE-2024-32113 | Critical | 9.8 | 2024-05-08 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. … |
CVE-2023-51467 | Critical | 9.8 | 2023-12-26 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code |
CVE-2023-49070 | Critical | 9.8 | 2023-12-05 | Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are re… |
CVE-2022-29063 | Critical | 9.8 | 2022-09-02 | The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosti… |
CVE-2022-25371 | Critical | 9.8 | 2022-09-02 | Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (htt… |
CVE-2021-37608 | Critical | 9.8 | 2021-08-18 | Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz ve… |
CVE-2021-30128 | Critical | 9.8 | 2021-04-27 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version |
CVE-2021-29200 | Critical | 9.8 | 2021-04-27 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack |
CVE-2021-26295 | Critical | 9.8 | 2021-03-22 | Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. |
CVE-2019-10074 | Critical | 9.8 | 2019-09-11 | An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the ca… |
CVE-2019-0189 | Critical | 9.8 | 2019-09-11 | The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java… |
CVE-2018-17200 | Critical | 9.8 | 2019-09-11 | The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoin… |
CVE-2017-15714 | Critical | 9.8 | 2018-01-04 | The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through th… |
CVE-2012-1622 | Critical | 9.8 | 2017-10-26 | Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2016-2170 | Critical | 9.8 | 2016-04-12 | Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, rel… |