CVE-2025-30676: Apache OFBiz reflected XSS in web page output

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS 6.1 medium severity with required user interaction, but high EPSS and a widely used product raise the practical risk.

What it is

Apache OFBiz before 18.12.19 fails to neutralize script-related HTML tags, allowing basic reflected cross-site scripting. Because OFBiz is a widely deployed business application platform, a successful attack can run script in a victim's browser session in the context of the application.

Impact

An attacker can execute arbitrary JavaScript in a victim's browser, potentially stealing session cookies, reading page content, or performing actions as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network with no authentication (PR:N), but exploitation requires the victim to interact with a crafted link or page (UI:R). The CVSS vector confirms network vector, low complexity, and user interaction.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at 0.676 (99.3rd percentile), suggesting elevated likelihood of attempted exploitation.

What to do

• Upgrade Apache OFBiz to 18.12.19 or later, which fixes the issue.
• If immediate upgrade is not possible, apply input validation and output encoding for script-related HTML tags on affected endpoints.
• Deploy a web application firewall rule set to block common XSS payloads targeting OFBiz.
• Restrict network exposure of OFBiz instances to trusted users where feasible.
• Monitor vendor advisory and Jira OFBIZ-13219 for patch details and backports.

Detection

• Inspect web server and application logs for requests containing script tags or event handler attributes in parameters.
• Monitor for anomalous JavaScript execution or outbound requests from user browsers following OFBiz page loads.
• Review WAF alerts for XSS patterns against OFBiz endpoints.
• Correlate suspicious session activity or cookie theft indicators with OFBiz access logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.