CVE-2025-54466

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin.

This issue affects Apache OFBiz: before 24.09.02 only when the scrum plugin is used.

Even unauthenticated attackers can exploit this vulnerability.

Users are recommended to upgrade to version 24.09.02, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Aug 15, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-544675.3When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in CVE-2025-544684.7A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for eCVE-2025-544699.9A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generateCVE-2025-54479.8A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.0CVE-2025-544708.6This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled,CVE-2025-544716.5NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret CVE-2025-544727.5Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the sCVE-2025-544739.2An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows codeCVE-2025-544748.5A SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla was discovered. The issue allows privileged users to execute arbitrCVE-2025-544758.7A SQL injection vulnerability in the JS Jobs plugin versions 1.3.2-1.4.4 for Joomla allows low-privilege users to execute arbitrary SQL commCVE-2025-544764.8Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.CVE-2025-544775.3Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.
CVE-2025-54466: Critical severity, CVSS 9.8 | Vulnix