Critical severity9.8NVD Advisory· Published Aug 15, 2025· Updated Jun 17, 2026
CVE-2025-54466
CVE-2025-54466
Description
Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.
This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used.
Even unauthenticated attackers can exploit this vulnerability.
Users are recommended to upgrade to version 24.09.02, which fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- Range: <24.09.02
Patches
Vulnerability mechanics
References
6- issues.apache.org/jira/browse/OFBIZ-13276nvdPatch
- lists.apache.org/thread/14d0yd9co9gx2mctd3vyz1cc8d39n915nvdMailing ListThird Party Advisory
- ofbiz.apache.org/security.htmlnvdVendor Advisory
- ofbiz.apache.org/download.htmlnvdProduct
- ofbiz.apache.org/release-notes-24.09.02.htmlnvdRelease Notes
- www.openwall.com/lists/oss-security/2025/08/05/1nvd
News mentions
0No linked articles in our index yet.