CVE-2026-31906

CVE-2026-31906: Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters

Vendor Apache Software Foundation

Product Apache OFBiz

Weakness CWE-79 · XSS

Published May 19, 2026

Last update May 19, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Key dates

02Disclosure timeline

May 19, 2026 CVE published

May 19, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-31906 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

04Related CVE

CVE-2026-66698 WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-76564 Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7 CVE-2026-73344 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability CVE-2026-13360 Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter CVE-2026-75948 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12