How many CVEs does Apache Software Foundation ofbiz have?

Apache Software Foundation ofbiz has 76 published CVE records since 2006.

How many Apache Software Foundation ofbiz CVEs are in CISA KEV?

Yes — 3 of Apache Software Foundation ofbiz's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for Apache Software Foundation ofbiz vulnerabilities?

Yes — 25 of Apache Software Foundation ofbiz's CVEs have a known public exploit.

Which versions of Apache Software Foundation ofbiz are affected?

87 distinct Apache Software Foundation ofbiz versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation ofbiz CVEs?

Apache Software Foundation ofbiz's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).

How many critical Apache Software Foundation ofbiz vulnerabilities are there?

Apache Software Foundation ofbiz has 27 critical and 19 high-severity CVEs.

What is the average severity of Apache Software Foundation ofbiz CVEs?

The average CVSS base score across Apache Software Foundation ofbiz's scored CVEs is 7.6.

Apache Software Foundation ofbiz Vulnerabilities: CVEs, CISA KEV & Security Advisories

Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass

CVE-2026-47342

Patch

CWE-285

High · CVSS 8.8

EPSS 0.4% (33th pct)2026-06-10

Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution

CVE-2026-50223

Patch

CWE-94

High · CVSS 8.8

EPSS 0.7% (48th pct)2026-06-10

Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution

CVE-2026-46586

Patch

CWE-95

High · CVSS 8.8

EPSS 0.5% (43th pct)2026-05-19

Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE

CVE-2026-45434

Public exploit

Patch

CWE-287

Critical · CVSS 9.8

EPSS 22.4% (97th pct)2026-05-19

Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs

CVE-2026-45187

Patch

CWE-285

Medium · CVSS 6.5

EPSS 0.5% (41th pct)2026-05-19

Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

CVE-2026-41919

Patch

CWE-90

Critical · CVSS 9.1

EPSS 0.5% (37th pct)2026-05-19

Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services

CVE-2026-35086

Patch

CWE-94

Medium · CVSS 6.5

EPSS 0.5% (40th pct)2026-05-19

Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection

CVE-2026-31986

Patch

CWE-321

Critical · CVSS 9.1

EPSS 0.4% (35th pct)2026-05-19

Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access

CVE-2026-31910

Patch

CWE-918

High · CVSS 7.5

EPSS 0.5% (37th pct)2026-05-19

Apache OFBiz: Unauthenticated Shipment Label Image Disclosure

CVE-2026-31909

Patch

CWE-200

High · CVSS 7.5

EPSS 0.5% (39th pct)2026-05-19

Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters

CVE-2026-31906

Patch

CWE-79

Medium · CVSS 6.1

EPSS 0.4% (36th pct)2026-05-19

Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature

CVE-2026-31388

Patch

CWE-284

Medium · CVSS 5.3

EPSS 0.4% (34th pct)2026-05-19

Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation

CVE-2026-31387

Patch

CWE-287

Medium · CVSS 5.3

EPSS 0.5% (41th pct)2026-05-19

Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass

CVE-2026-31380

Patch

CWE-917

Medium · CVSS 6.5

EPSS 0.5% (39th pct)2026-05-19

Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager

CVE-2026-31379

Patch

CWE-94

Medium · CVSS 6.1

EPSS 0.6% (45th pct)2026-05-19

Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution

CVE-2026-31378

Patch

CWE-20

Medium · CVSS 6.5

EPSS 0.6% (44th pct)2026-05-19

Apache OFBiz: Low-Privilege SSRF in Content Component

CVE-2026-29226

Patch

CWE-918

High · CVSS 7.3

EPSS 0.5% (38th pct)2026-05-19

Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component

CVE-2026-29207

Patch

CWE-1336

Medium · CVSS 6.5

EPSS 0.5% (42th pct)2026-05-19

Apache OFBiz: Low-Privilege LFI in Content Component

CVE-2026-29220

Patch

CWE-22

Medium · CVSS 6.5

EPSS 0.7% (49th pct)2026-05-19

Apache OFBiz: Reflected Cross-site Scripting

CVE-2025-61623

Patch

Workaround

CWE-79

Medium · CVSS 6.5

EPSS 0.8% (52th pct)2025-11-12

Apache OFBiz: Critical Remote Command Execution via Unrestricted File Upload

CVE-2025-59118

Patch

Workaround

CWE-434

High · CVSS 7.3

EPSS 1.6% (73th pct)2025-11-12

Apache OFBiz: RCE Vulnerability in scrum plugin

CVE-2025-54466

Patch

Workaround

CWE-94

Critical · CVSS 9.8

EPSS 15.0% (96th pct)2025-08-15

Apache OFBiz: Stored XSS Vulnerability

CVE-2025-30676

Patch

Workaround

CWE-80

Medium · CVSS 6.1

EPSS 65.3% (99th pct)2025-04-01

Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

CVE-2025-26865

Patch

Workaround

CWE-1336

Low · CVSS 3.5

EPSS 0.6% (46th pct)2025-03-10

Critical vulnerability · 2024-11-18

CVE-2024-47208

Patch

Workaround

CWE-918

Critical · CVSS 9.8

EPSS 1.6% (73th pct)2024-11-18

Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

CVE-2024-48962

Patch

Workaround

CWE-352

High · CVSS 8.9

EPSS 0.6% (46th pct)2024-11-18

Apache OFBiz: Confused controller-view authorization logic (forced browsing)

CVE-2024-45195

CISA KEV

Public exploit

Patch

Workaround

CWE-425

Added to CISA KEV 2025-02-04

Critical · CVSS 9.3

EPSS 100.0% (100th pct)2024-09-04

Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

CVE-2024-45507

Public exploit

Patch

Workaround

CWE-94

Critical · CVSS 9.8

EPSS 93.4% (100th pct)2024-09-04

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

CVE-2024-38856

CISA KEV

Public exploit

Patch

Workaround

CWE-863

Added to CISA KEV 2024-08-27

Critical · CVSS 9.3

EPSS 99.4% (100th pct)2024-08-05

Critical vulnerability · 2024-06-04

CVE-2024-36104

Public exploit

Patch

Workaround

CWE-22

Critical · CVSS 9.1

EPSS 87.4% (100th pct)2024-06-04

Apache Software Foundation ofbiz Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other Apache Software Foundation products

Frequently asked questions

References

Track Apache Software Foundation ofbiz vulnerabilities