Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache OFBiz

97 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-74841

    Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode

    In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every d…

    Apache Software Foundation Apache OFBiz
  • Critical 9.8
    CVE-2026-81815

    Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB

    SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case…

    Apache Software Foundation Apache OFBiz
  • Critical 9.8
    CVE-2026-82907

    Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

    Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session …

    Apache Software Foundation Apache OFBiz
  • Critical 9.8
    CVE-2026-83542 Public exploit

    Apache OFBiz: Unauthenticated RCE via login-page widget injection

    Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overridin…

    Apache Software Foundation Apache OFBiz
  • Critical 9.8
    CVE-2026-105330

    Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access

    Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default …

    Apache Software Foundation Apache OFBiz
  • Critical 9.8
    CVE-2026-45434 EPSS 21%

    Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE

    Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Critical 9.1
    CVE-2026-41919

    Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Critical 9.1
    CVE-2026-31986

    Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection

    Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Critical 9.8
    CVE-2024-47208

    Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

    Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Critical 9.8
    CVE-2024-45195 Exploited Public exploit Scanner template EPSS 100%

    Apache OFBiz: Confused controller-view authorization logic (forced browsing)

    Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

    Apache Software Foundation Apache OFBiz
    KEV Feb 4, 2025
  • Critical 9.1
    CVE-2024-36104 Public exploit Scanner template EPSS 88%

    Apache OFBiz: Path traversal leading to a RCE

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Critical 9.1
    CVE-2024-32113 Exploited Public exploit Scanner template EPSS 100%

    Apache OFBiz: Path traversal leading to RCE

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.

    Apache Software Foundation Apache OFBiz
    KEV Aug 7, 2024
  • Critical 9.1
    CVE-2024-25065 EPSS 48%

    Apache OFBiz: Path traversal allowing authentication bypass.

    Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.

    Apache Software Foundation Apache OFBiz