CVE-2025-61623

Description

Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.

PUBLISHED Reserved 2025-09-29 | Published 2025-11-12 | Updated 2025-11-12 | Assigner apache

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Credits

RedHive Team (security@hive.red) https://hive.red/en/ finder

References

www.openwall.com/lists/oss-security/2025/11/11/2

issues.apache.org/jira/browse/OFBIZ-13295 issue-tracking

ofbiz.apache.org/download.html mitigation

ofbiz.apache.org/security.html patch

ofbiz.apache.org/release-notes-24.09.03.html release-notes

lists.apache.org/thread/sb2mngrg766qbqt5g29fo0qblk3v4x5y vendor-advisory

cve.org (CVE-2025-61623)

nvd.nist.gov (CVE-2025-61623)

Download JSON