CVE-2019-10074

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533

• CWE-74
• CWE-116

• https://lists.apache.org/thread.html/a02aaa4c19dfd520807cf6b106b71aad0131a6543f7f60802ae71ec2%40%3Cnotifications.ofbiz.apache.org%3E
• https://s.apache.org/r49vwMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/a02aaa4c19dfd520807cf6b106b71aad0131a6543f7f60802ae71ec2%40%3Cnotifications.ofbiz.apache.org%3E
• https://s.apache.org/r49vwMailing List, Vendor Advisory

Published

Sep 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10069In Godot through 3.1, remote code execution is possible due …
• CVE-2019-1007An elevation of privilege exists in Windows Audio Service. A…7.8
• CVE-2019-10070Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable …6.1
• CVE-2019-10071The code which checks HMAC in form submissions used String.e…9.8
• CVE-2019-10072The fix for CVE-2019-0199 was incomplete and did not address…
• CVE-2019-10073The "Blog", "Forum", "Contact Us" screens of the template "e…6.1
• CVE-2019-10075Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-10076A carefully crafted malicious attachment could trigger an XS…
• CVE-2019-10077A carefully crafted InterWiki link could trigger an XSS vuln…
• CVE-2019-10078A carefully crafted plugin link invocation could trigger an …
• CVE-2019-10079Apache Traffic Server is vulnerable to HTTP/2 setting flood …7.5
• CVE-2019-1008A security feature bypass vulnerability exists in Dynamics O…