CVE-2025-54466

critical · 9.8

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used. Even unauthenticated attackers can exploit this vulnerability. Users are recommended to upgrade to version 24.09.02, which fixes the issue.

9.8

CVSS

16.4%

EPSS (exploit prob.)

97th

EPSS percentile

2025-08-15

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
apache	ofbiz	< 24.09.02

Check a specific version with /api/v1/cve/match.

References

https://issues.apache.org/jira/browse/OFBIZ-13276
https://lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915
https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/release-notes-24.09.02.html
https://ofbiz.apache.org/security.html
http://www.openwall.com/lists/oss-security/2025/08/05/1

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-54466