Apache Ofbiz vulnerabilities
76 published vulnerabilities in Apache Ofbiz, 3 of them exploited in the wild. The most were published in 2026 (19), and 19 so far in 2026.
Apache Ofbiz vulnerabilities by year
2006
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Apache Ofbiz vulnerabilities
- CVE-2024-45195 Apache OFBiz Forced Browsing
- CVE-2024-32113 Apache OFBiz Path Traversal
- CVE-2024-38856 Apache OFBiz Incorrect Authorization
- CVE-2013-2250 Code injection in n/a
- CVE-2012-3506 Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
- CVE-2026-45434 Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE
- CVE-2024-47208 Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE
- CVE-2023-51467 Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
- CVE-2023-49070 Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
- CVE-2022-25371 Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz
- CVE-2022-29063 Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz
- CVE-2021-37608 Arbitrary file upload vulnerability in OFBiz
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.