PT-2025-14118

CVE-2025-30676

Published

2025-04-01

Updated

2026-07-06

Description by

CVSS 2.0

6.4

Medium

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.19

Description The issue is related to Improper Neutralization of Script-Related HTML Tags in a Web Page, also known as Basic XSS. This is a type of security vulnerability that occurs when an application fails to properly neutralize script-related HTML tags, allowing an attacker to inject malicious scripts into a web page.

Recommendations For Apache OFBiz versions prior to 18.12.19, upgrade to version 18.12.19 to fix the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Khaled Nassar

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)