CVE-2026-82910

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...