Apache Ofbiz vulnerabilities

CVE-2016-6800 [MEDIUM] CWE-79 CVE-2016-6800: The default configuration of the Apache OFBiz framework offers a blog functionality. Different users The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not properly sanitized. It is possible to inject arbitrary JavaS

CVE-2020-13923 [MEDIUM] CWE-639 CVE-2020-13923: IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 1 IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04

CVE-2022-25370 [MEDIUM] CWE-79 CVE-2022-25370: Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualiza Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inj

CVE-2023-46819 [MEDIUM] CWE-306 CVE-2023-46819: Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This i Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are recommended to upgrade to version 18.12.09

CVE-2019-10073 [MEDIUM] CWE-79 CVE-2019-10073: The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616

CVE-2026-31387 [MEDIUM] CWE-287 CVE-2026-31387: Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.0 Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVE-2026-31379 [MEDIUM] CWE-22 CVE-2026-31379: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 2

CVE-2026-31388 [MEDIUM] CWE-284 CVE-2026-31388: Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affec Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVE-2026-31906 [MEDIUM] CWE-79 CVE-2026-31906: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVE-2014-0232 [MEDIUM] CWE-79 CVE-2014-0232: Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages. Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1) result or (2) error message.

CVE-2013-2137 [MEDIUM] CWE-79 CVE-2013-2137: Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apa Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2012-1621 [MEDIUM] CWE-79 CVE-2012-1621: Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates, the (2) contentId or (3) mapKey parameter in a cms event request, which are not properly handled in an error message,

CVE-2025-26865 [LOW] CWE-1336 CVE-2025-26865: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used. In other words, if y