Vulnerability · Published Nov 5, 2026 · Assigned by apache

CVE-2026-114229Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session

Unrated

In plain English

A cross-site scripting in Apache OFBiz from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS )–Not rated

Exploit odds (30 days)0.2%top 90.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache OFBiz	0 – before 24.09.08

Weakness: CWE-79

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz vendor-advisory