Unrated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the...

CVE-2026-114229 First seen on SecPulse Nov 5, 22:36

Affected packages

Ecosystem	Package	Affected	Fixed
Apache Software Foundation	Apache OFBiz	< 24.09.08	24.09.08

Original description The description as published by the source.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

Severity: Unrated
Published: Nov 5, 2026
First seen on SecPulse: Nov 5, 22:36
GHSA: GHSA-h337-fr2g-8mjw
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

JavaScript

Web Frameworks

Apache

Attack Types

Cross-Site Scripting

CWE

CWE-79

All

Apache Software Foundation Apache Ofbiz

Detection sources

NIST National Vulnerability DatabaseNov 5, 23:48
GitHub Security Advisories (Global)00:34
CVE.org (CVE Program・cvelistV5)Nov 5, 22:36