Krishna Uprit

Apache OFBiz: Unauthenticated RCE via login-page widget injection

Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading

Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile

Apache OFBiz: Unbounded multi-form row count from a parameter name

Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

Apache OFBiz: renderLink compiles link parameters as FreeMarker source

Apache OFBiz: Unsandboxed Groovy compiled from a service parameter

Apache OFBiz: webtools xmldsdump exports any entity to any path

Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE

Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers