4 results (0.013 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2025-30676 – Apache OFBiz: Stored XSS Vulnerability

https://notcve.org/view.php?id=CVE-2025-30676

01 Apr 2025 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue. • https://issues.apache.org/jira/browse/OFBIZ-13219 • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •

CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2025-26865 – Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

https://notcve.org/view.php?id=CVE-2025-26865

10 Mar 2025 — Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used. In other words, if you use 18.12.17 you are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is. • https://issues.apache.org/jira/browse/OFBIZ-12594 • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-47208 – Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

https://notcve.org/view.php?id=CVE-2024-47208

18 Nov 2024 — Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue. • https://issues.apache.org/jira/browse/OFBIZ-13158 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 8.9EPSS: 0%CPEs: 1EXPL: 0

CVE-2024-48962 – Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

https://notcve.org/view.php?id=CVE-2024-48962

18 Nov 2024 — Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue. • https://issues.apache.org/jira/browse/OFBIZ-13162 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-352: Cross-Site Request Forgery (CSRF) CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •