Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

76 results · page 1 of 2

Jun 10, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource ediCVE-2026-50223 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Jun 10, 2026A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: CVE-2026-47342 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability CVE-2026-46586 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 2CVE-2026-45434 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Authorization vulnerability in Apache OFBiz Webtools.CVE-2026-45187 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.CVE-2026-41919 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz.CVE-2026-35086 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.CVE-2026-31986 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz.CVE-2026-31910 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz.CVE-2026-31909 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz.CVE-2026-31906 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.CVE-2026-31388 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Authentication vulnerability in Apache OFBiz.CVE-2026-31387 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.CVE-2026-31380 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path TraversCVE-2026-31379 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Input Validation vulnerability in Apache OFBiz.CVE-2026-31378 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.CVE-2026-29226 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.CVE-2026-29220 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
May 19, 2026Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.CVE-2026-29207 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported. Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org openwall.com
Nov 12, 2025Reflected cross-site scripting vulnerability in Apache OFBiz.CVE-2025-61623 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Nov 12, 2025Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz.CVE-2025-59118 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.3
Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Aug 15, 2025Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.CVE-2025-54466 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Apr 1, 2025Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.CVE-2025-30676 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Mar 10, 2025Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.CVE-2025-26865 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 3.5
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used. In other words, if you use 18.12.17 you are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is. In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Nov 18, 2024Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template ECVE-2024-48962 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.9
Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Nov 18, 2024Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.CVE-2024-47208 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Sep 4, 2024Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.CVE-2024-45507 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Sep 4, 2024Apache OFBiz Forced Browsing VulnerabilityCVE-2024-45195 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.5
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
Product
OFBiz
On CISA’s list since
Feb 4, 2025 (federal fix deadline Feb 25, 2025)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.apache.org
Aug 5, 2024Apache OFBiz Incorrect Authorization VulnerabilityCVE-2024-38856 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Product
OFBiz
On CISA’s list since
Aug 27, 2024 (federal fix deadline Sep 17, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog issues.apache.org lists.apache.org
Jun 4, 2024Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.CVE-2024-36104 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com issues.apache.org
May 8, 2024Apache OFBiz Path Traversal VulnerabilityCVE-2024-32113 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
Product
OFBiz
On CISA’s list since
Aug 7, 2024 (federal fix deadline Aug 28, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com issues.apache.org
Feb 28, 2024Possible path traversal in Apache OFBiz allowing authentication bypass.CVE-2024-25065 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Possible path traversal in Apache OFBiz allowing authentication bypass. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com issues.apache.org
Feb 28, 2024Possible path traversal in Apache OFBiz allowing file inclusion.CVE-2024-23946 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Possible path traversal in Apache OFBiz allowing file inclusion. Users are recommended to upgrade to version 18.12.12, that fixes the issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com issues.apache.org
Dec 26, 2023The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code CVE-2023-51467 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.apache.org lists.apache.org
Dec 26, 2023Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.CVE-2023-50968 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com issues.apache.org
Dec 5, 2023Pre-auth RCE in Apache Ofbiz 18.12.09.CVE-2023-49070 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com issues.apache.org
Nov 7, 2023Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin.CVE-2023-46819 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are recommended to upgrade to version 18.12.09
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org ofbiz.apache.org
Apr 14, 2023Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin.CVE-2022-47501 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Sep 2, 2022Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticatCVE-2022-29158 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Sep 2, 2022The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099.CVE-2022-29063 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code. Upgrade to at least 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12646.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Sep 2, 2022In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “SuCVE-2022-25813 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Sep 2, 2022Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports.CVE-2022-25371 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz uses the Birt project plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. By leveraging a bug in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142) it is possible to perform a remote code execution (RCE) attack in Apache OFBiz, release 18.12.05 and earlier.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Sep 2, 2022Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports.CVE-2022-25370 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Apache OFBiz uses the Birt plugin (https://eclipse.github.io/birt-website/) to create data visualizations and reports. In Apache OFBiz release 18.12.05, and earlier versions, by leveraging a vulnerability in Birt (https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142), an unauthenticated malicious user could perform a stored XSS attack in order to inject a malicious payload and execute it using the stored XSS.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com openwall.com
Aug 30, 2021In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info whichCVE-2021-25958 · Websites & servers · apache · reported by vulnerabilitylab@mend.ioMedium 6.5
In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.
Product
ofbiz-framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com whitesourcesoftware.com
Aug 18, 2021Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands.CVE-2021-37608 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz version 17.12.07 and prior versions. Upgrade to at least 17.12.08 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Apr 27, 2021Apache OFBiz has unsafe deserialization prior to 17.12.07 versionCVE-2021-30128 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz has unsafe deserialization prior to 17.12.07 version
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Apr 27, 2021Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attackCVE-2021-29200 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Mar 22, 2021Apache OFBiz has unsafe deserialization prior to 17.12.06.CVE-2021-26295 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
Product
Apache OFBiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com lists.apache.org
Jul 15, 2020XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03CVE-2020-9496 · Websites & servers · Apache · reported by security@apache.orgMedium 6.1
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
Product
Ofbiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jul 15, 2020IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04CVE-2020-13923 · Websites & servers · Apache · reported by security@apache.orgMedium 5.3
IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04
Product
Ofbiz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.