CVE-2021-26295
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
Date published : 2021-03-22
http://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html