CVE-2026-114229

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a...