Known vulnerabilities in Apache OFBiz - page 2

Vendor: Apache Foundation
Software: Apache OFBiz
Software CPE: cpe:2.3:a:apache_foundation:ofbiz:*:*:*:*:*:*:*:*
Website: https://www.apache.org
Total vulnerabilities: 63
Public exploits: 11
Known exploited (KEV): 5
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache OFBiz Apache OFBiz is affected by 63 known vulnerabilities: 3 critical, 25 high, 15 medium, 20 low Critical High Medium Low

Vulnerabilities (63)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU118310 - Unrestricted Upload of File with Dangerous Type
CVE-2025-59118		 CWE-434 Critical
No
No
 24.09.03 11.11.2025 SB2025111174
#VU106966 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-30676		 CWE-79 Low
No
No
 18.12.19 03.04.2025 SB2025040396
#VU100779 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-48962		 CWE-94 High
No
No
 18.12.17 21.11.2024 SB2024112149
#VU100778 - Server-Side Request Forgery (SSRF)
CVE-2024-47208		 CWE-918 High
No
No
 18.12.17 21.11.2024 SB2024112149
#VU96747 - Server-Side Request Forgery (SSRF)
CVE-2024-45507		 CWE-918 High
No
No
 18.12.16 03.09.2024 SB2024090378
#VU96746 - Direct Request ('Forced Browsing')
CVE-2024-45195		 CWE-425 High
No
Exploited
 18.12.16 03.09.2024 SB2024090378
#VU95407 - Improper Authorization
CVE-2024-38856		 CWE-285 High
Available
Exploited
 18.12.15 06.08.2024 SB2024080628
#VU92130 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-32113		 CWE-22 High
Available
Exploited
 18.12.13 14.06.2024 SB2024061426
#VU91168 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-36104		 CWE-22 High
No
No
 18.12.14 05.06.2024 SB2024060530
#VU86953 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-25065		 CWE-22 Medium
No
No
 18.12.12, 22.01.01 01.03.2024 SB2024030135
#VU86754 - Exposure of sensitive information to an unauthorized actor
CVE-2024-23946		 CWE-200 Medium
No
No
 18.12.12, 22.01.01 23.02.2024 SB2024022314
#VU84796 - Server-Side Request Forgery (SSRF)
CVE-2023-51467		 CWE-918 Critical
Available
Exploited
 18.12.11 27.12.2023 SB2023122715
#VU84795 - Server-Side Request Forgery (SSRF)
CVE-2023-50968		 CWE-918 Medium
No
No
 18.12.11 27.12.2023 SB2023122715
#VU83884 - Use of Potentially Dangerous Function
CVE-2023-49070		 CWE-676 High
Available
No
 18.12.10 05.12.2023 SB2023120526
#VU74615 - Improper Access Control
CVE-2022-47501		 CWE-284 Medium
No
No
 18.12.07 10.04.2023 SB2023041022
#VU74614 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-25370		 CWE-79 Low
No
No
 18.12.06 10.04.2023 SB2023041021
#VU74613 - Improper input validation
CVE-2022-25371		 CWE-20 High
No
No
 18.12.06 10.04.2023 SB2023041021
#VU74612 - Incorrect Regular Expression
CVE-2022-29158		 CWE-185 Medium
No
No
 18.12.06 10.04.2023 SB2023041021
#VU74611 - Insufficient Verification of Data Authenticity
CVE-2022-29063		 CWE-345 Low
No
No
 18.12.06 10.04.2023 SB2023041021
#VU74610 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-25813		 CWE-94 High
No
No
 18.12.06 10.04.2023 SB2023041021


Showing elements 21 - 40 out of 63