CVE-20XX-?

Apache Ofbiz CVEs.

Published CVEs affecting Apache Ofbiz, ranked by exploit odds.

24 CVEs · updated 2026-11-06 09:39 UTC

  1. CVE-2025-30676

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue.

    XSS Server Apache Ofbiz

    6.1 MEDIUM 68% exploit odds Fix listed
  2. CVE-2025-54466

    Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue.

    Injection Web app Apache Ofbiz

    9.8 CRITICAL 28% exploit odds Fix listed
  3. CVE-2026-45434

    Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Auth & access Web app Apache Ofbiz

    9.8 CRITICAL 21% exploit odds Fix listed
  4. CVE-2025-59118

    Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.

    Code execution Web app Apache Ofbiz

    7.3 HIGH 2% exploit odds Fix listed
  5. CVE-2025-61623

    Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.

    XSS Web app Apache Ofbiz

    6.5 MEDIUM 0.8% exploit odds Fix listed
  6. CVE-2026-46586

    Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Injection Web app Apache Ofbiz

    8.8 HIGH 0.7% exploit odds Fix listed
  7. CVE-2026-29220

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Disclosure Web app Apache Ofbiz

    6.5 MEDIUM 0.7% exploit odds Fix listed
  8. CVE-2025-26865

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.   It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used. In other words, if you use 18.12.17 you are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is. In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.

    Injection Web app Apache Ofbiz

    3.5 LOW 0.7% exploit odds Fix listed
  9. CVE-2026-50223

    Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.

    Injection Web app Apache Ofbiz

    8.8 HIGH 0.7% exploit odds Fix listed
  10. CVE-2026-31379

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Disclosure Web app Apache Ofbiz

    6.1 MEDIUM 0.6% exploit odds Fix listed
  11. CVE-2026-31378

    Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Other Web app Apache Ofbiz

    6.5 MEDIUM 0.6% exploit odds Fix listed
  12. CVE-2026-29207

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported. Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.

    Injection Web app Apache Ofbiz

    6.5 MEDIUM 0.5% exploit odds Fix listed
  13. CVE-2026-31387

    Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Auth & access Web app Apache Ofbiz

    5.3 MEDIUM 0.5% exploit odds Fix listed
  14. CVE-2026-45187

    Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Auth & access Web app Apache Ofbiz

    6.5 MEDIUM 0.5% exploit odds Fix listed
  15. CVE-2026-35086

    Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Injection Server Apache Ofbiz

    6.5 MEDIUM 0.5% exploit odds Fix listed
  16. CVE-2026-31380

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Injection Web app Apache Ofbiz

    6.5 MEDIUM 0.5% exploit odds Fix listed
  17. CVE-2026-31909

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Disclosure Web app Apache Ofbiz

    7.5 HIGH 0.5% exploit odds Fix listed
  18. CVE-2026-29226

    Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Disclosure Web app Apache Ofbiz

    7.3 HIGH 0.5% exploit odds Fix listed
  19. CVE-2026-31910

    Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Disclosure Web app Apache Ofbiz

    7.5 HIGH 0.5% exploit odds Fix listed
  20. CVE-2026-41919

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Injection Web app Apache Ofbiz

    9.1 CRITICAL 0.5% exploit odds Fix listed
  21. CVE-2026-31906

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    XSS Web app Apache Ofbiz

    6.1 MEDIUM 0.4% exploit odds Fix listed
  22. CVE-2026-31986

    Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Crypto Web app Apache Ofbiz

    9.1 CRITICAL 0.4% exploit odds Fix listed
  23. CVE-2026-31388

    Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Auth & access Web app Apache Ofbiz

    5.3 MEDIUM 0.4% exploit odds Fix listed
  24. CVE-2026-47342

    A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.

    Auth & access Web app Apache Ofbiz

    8.8 HIGH 0.4% exploit odds Fix listed

All CVEs affecting Apache Ofbiz that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.