# Apache Ofbiz


- [CVE-2024-45195](https://insights.sbomify.com/CVE-2024-45195/): Apache OFBiz Forced Browsing (critical 9.8, exploited in the wild)
- [CVE-2024-32113](https://insights.sbomify.com/CVE-2024-32113/): Apache OFBiz Path Traversal (critical 9.1, exploited in the wild)
- [CVE-2024-38856](https://insights.sbomify.com/CVE-2024-38856/): Apache OFBiz Incorrect Authorization (high 8.1, exploited in the wild)
- [CVE-2013-2250](https://insights.sbomify.com/CVE-2013-2250/): Code injection in n/a (critical 10.0)
- [CVE-2012-3506](https://insights.sbomify.com/CVE-2012-3506/): Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors. (critical 10.0)
- [CVE-2026-45434](https://insights.sbomify.com/CVE-2026-45434/): Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE (critical 9.8)
- [CVE-2024-47208](https://insights.sbomify.com/CVE-2024-47208/): Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE (critical 9.8)
- [CVE-2023-51467](https://insights.sbomify.com/CVE-2023-51467/): Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability (critical 9.8)
- [CVE-2023-49070](https://insights.sbomify.com/CVE-2023-49070/): Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present (critical 9.8)
- [CVE-2022-25371](https://insights.sbomify.com/CVE-2022-25371/): Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz (critical 9.8)
- [CVE-2022-29063](https://insights.sbomify.com/CVE-2022-29063/): Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz (critical 9.8)
- [CVE-2021-37608](https://insights.sbomify.com/CVE-2021-37608/): Arbitrary file upload vulnerability in OFBiz (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/apache/ofbiz/