CVE-2026-114229

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a...

CVE-2026-114229

A Reflected Cross-site Scripting (XSS) vulnerability exists in the Catalog image viewer of Apache OFBiz versions 24.09 before 24.09.08 on all platforms. The root cause is the improper neutralization of input during web page generation. This allows an unauthenticated attacker to execute arbitrary ...