Priority MEDIUM 41
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00717 · Published 2026-05-19 · Fixed in 24.09.06 CWE-94
Priority HIGH 68
Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.21264 · Published 2026-05-19 · Fixed in 24.09.06 CWE-287
Priority LOW 35
Improper Authorization vulnerability in Apache OFBiz Webtools.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00513 · Published 2026-05-19 · Fixed in 24.09.06 CWE-285
Priority MEDIUM 48
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00454 · Published 2026-05-19 · Fixed in 24.09.06 CWE-90
Priority LOW 31
Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00497 · Published 2026-05-19 · Fixed in 24.09.06 CWE-94
Priority MEDIUM 48
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00436 · Published 2026-05-19 · Fixed in 24.09.06 CWE-321
Priority LOW 39
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0046 · Published 2026-05-19 · Fixed in 24.09.06 CWE-918
Priority LOW 39
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00486 · Published 2026-05-19 · Fixed in 24.09.06 CWE-200
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0044 · Published 2026-05-19 · Fixed in 24.09.06 CWE-79
Priority LOW 30
Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00416 · Published 2026-05-19 · Fixed in 24.09.06 CWE-284
Priority LOW 31
Improper Authentication vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00515 · Published 2026-05-19 · Fixed in 24.09.06 CWE-287
Priority LOW 35
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00487 · Published 2026-05-19 · Fixed in 24.09.06 CWE-917
Priority LOW 28
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injectio…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00588 · Published 2026-05-19 · Fixed in 24.09.06 CWE-22
Priority LOW 36
Improper Input Validation vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00574 · Published 2026-05-19 · Fixed in 24.09.06 CWE-20
Priority LOW 39
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-05-19 · Fixed in 24.09.06 CWE-918
Priority LOW 36
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00541 · Published 2026-05-19 · Fixed in 24.09.06 CWE-1336
Priority LOW 36
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00684 · Published 2026-05-19 · Fixed in 24.09.06 CWE-22
THREATIST.IORead the docs