Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache OFBiz

97 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.5
    CVE-2026-81816

    Apache OFBiz: XML external entity injection (XXE)

    XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by stor…

    Apache Software Foundation Apache OFBiz
  • Low 3.5
    CVE-2025-26865 Public exploit

    Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.   It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which …

    Apache Software Foundation Apache OFBiz