CVE-2022-25813: Apache OFBiz

High severity, CVSS 7.5. EPSS: 67.3% chance of exploitation in the next 30 days.

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.

Affected products

• Apache OFBiz: before 18.12.06 (fixed in 18.12.06)

Published 2022-09-02. Last modified 2026-06-17.