Veille CVE

Recherche « Apache ofbiz »

20 CVE

Critique 4 Élevée 6 Moyenne 10 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Apache ofbiz » ✕
  1. CVE-2026-50223 8.8 Élevée

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.

  2. CVE-2026-47342 8.8 Élevée

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.

  3. CVE-2026-46586 8.8 Élevée

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  4. CVE-2026-45434 9.8 Critique

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  5. CVE-2026-45187 6.5 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  6. CVE-2026-41919 9.1 Critique

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  7. CVE-2026-35086 6.5 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  8. CVE-2026-31986 9.1 Critique

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  9. CVE-2026-31910 7.5 Élevée

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  10. CVE-2026-31909 7.5 Élevée

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  11. CVE-2026-31906 6.1 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  12. CVE-2026-31388 5.3 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  13. CVE-2026-31387 5.3 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  14. CVE-2026-31380 6.5 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  15. CVE-2026-31379 6.1 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  16. CVE-2026-31378 6.5 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  17. CVE-2026-29226 7.3 Élevée

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  18. CVE-2026-29220 6.5 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

  19. CVE-2026-29207 6.5 Moyenne

    Apache Software Foundation Apache OFBiz · Apache ofbiz

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported. Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.

  20. CVE-2024-38856 9.8 Critique Exploitée

    Apache Software Foundation Apache OFBiz · apache ofbiz

    Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).