CVE-2025-54466

9.8 criticalEPSS 27%

Critical (9.8) in apache ofbiz. EPSS 27% chance of exploitation in the next 30 days.

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 27% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2025-08-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:ofbiz

References

https://issues.apache.org/jira/browse/OFBIZ-13276
https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915
https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/release-notes-24.09.02.html
https://ofbiz.apache.org/security.html

Check your stack JSON