Apache Software Foundation Apache Ofbiz vulnerabilities

CVE-2026-31380 [MEDIUM] CWE-917 CVE-2026-31380: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression La Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVE-2025-61623 [MEDIUM] CWE-79 CVE-2025-61623: Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: befo Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.

CVE-2024-23946 [MEDIUM] CWE-22 CVE-2024-23946: Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.

CVE-2016-6800 [MEDIUM] CWE-79 CVE-2016-6800: The default configuration of the Apache OFBiz framework offers a blog functionality. Different users The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not properly sanitized. It is possible to inject arbitrary JavaS

CVE-2022-25370 [MEDIUM] CWE-79 CVE-2022-25370: Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualiza Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inj

CVE-2023-46819 [MEDIUM] CWE-306 CVE-2023-46819: Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This i Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are recommended to upgrade to version 18.12.09

CVE-2026-31387 [MEDIUM] CWE-287 CVE-2026-31387: Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.0 Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVE-2026-31379 [MEDIUM] CWE-22 CVE-2026-31379: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 2

CVE-2026-31388 [MEDIUM] CWE-284 CVE-2026-31388: Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affec Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVE-2026-31906 [MEDIUM] CWE-79 CVE-2026-31906: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVE-2025-26865 [LOW] CWE-1336 CVE-2025-26865: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used. In other words, if y