Apache OFBiz CVE-2026-114229

Exploitation requires an attacker to craft a URL for the OFBiz Catalog Image Viewer that reflects unsanitized input back into the page as executable script, and requires a victim to open that link - user interaction is the primary limiting factor, so this cannot be triggered server-to-server without a human target. The specific reflecting parameter and endpoint are not described in the available sources. Whether the victim must be authenticated to OFBiz is not confirmed from the data (no CVSS vector supplied); the practical impact is bounded to whatever privileges the victim's session holds, and is contained to versions prior to 24.09.08.

This is a reflected cross-site scripting flaw in the Apache OFBiz Catalog Image Viewer that allows script execution in a victim's browser session. No quantitative signals are available to triage it: the input provides no CVSS vector, no EPSS probability, no KEV listing, and no PoC/exploit reference, and the vuln.today Decision label is 'awaiting_data' - so all severity reasoning here is inferred from the CVE title and the XSS vulnerability class, not confirmed by a vendor score. By its nature, reflected XSS is not a server-side code-execution or data-at-rest flaw: it requires a victim to be lured into clicking an attacker-crafted link, which materially lowers real-world risk compared to the pre-authentication RCE issues disclosed in the same OFBiz batch (e.g. CVE-2026-68524, CVE-2026-83542). The realistic impact is session-scoped - theft of session context, action-on-behalf-of-user, or UI redressing against whoever opens the link - rather than host compromise. Because no CVSS vector is supplied, authentication requirements cannot be confirmed from the data; the Catalog Image Viewer is typically a catalog-facing feature, which suggests exploitation may not require the attacker to be authenticated, but this is inferred and not stated in the sources. Net assessment: a genuine but lower-tier issue within this advisory - it should be remediated as part of the 24.09.08 upgrade, but it is not the headline risk of the release and there is no evidence of active exploitation.

An attacker crafts a malicious URL targeting the OFBiz Catalog Image Viewer that reflects attacker-controlled script into the rendered page, then delivers it to a victim via phishing or a planted link. When the victim opens the link in an authenticated OFBiz context, the script runs in their session and can act with their privileges or exfiltrate session data. No public exploit code is identified in the provided sources, and success depends on the victim interacting with the crafted link.