CVE-2025-61623

CVE-2025-61623: Apache OFBiz: Reflected Cross-site Scripting

Vendor Apache Software Foundation

Product Apache OFBiz

Weakness CWE-79 · XSS

Published November 12, 2025

Last update November 12, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.

Key dates

02Disclosure timeline

November 12, 2025 CVE published

November 12, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-61623 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

04Related CVE

CVE-2026-10734 Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint CVE-2026-32547 WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter CVE-2026-6178 Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode CVE-2026-28568 WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability