Apache OFBiz

4 results · Clear filters · Feed

• High 7.5
  CVE-2026-68524 Public exploit

  Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading

  An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. The described vulnerability was discovered independantly twice, with eac…

  Apache Software Foundation Apache OFBiz
  Nov 5, 2026
• High 7.5
  CVE-2026-73577 Public exploit

  Apache OFBiz: Unauthenticated path-suffix view authorization bypass

  Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., …

  Apache Software Foundation Apache OFBiz
  Nov 5, 2026
• High 8.8
  CVE-2024-45507 Public exploit Scanner template EPSS 96%

  Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

  Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

  Apache Software Foundation Apache OFBiz
  Sep 4, 2024
• High 8.1
  CVE-2024-38856 Exploited Public exploit Scanner template EPSS 99%

  Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

  Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of …

  Apache Software Foundation Apache OFBiz
  Aug 5, 2024

  KEV Aug 27, 2024