Apache ActiveMQ EUVD-2026-25411

| CVE-2026-41043 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-04-24 apache GHSA-2jp3-2923-9h52
XSS Apache Apache Activemq Apache Activemq Web
6.5
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Analysis Generated
Apr 24, 2026 - 21:30 vuln.today
CVSS changed
Apr 24, 2026 - 19:22 NVD
6.5 (None) 6.5 (MEDIUM)
Patch available
Apr 24, 2026 - 12:16 EUVD

DescriptionNVD

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.

An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field.

This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5.

Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue.

AnalysisAI

Stored XSS in Apache ActiveMQ and Apache ActiveMQ Web allows authenticated attackers to inject malicious HTML into JMS selector fields, which displays when other users browse queues in the web console. Affects ActiveMQ versions before 5.19.6 and 6.0.0 through 6.2.4; ActiveMQ Web before 5.19.6 and 6.0.0 through 6.2.4. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

EUVD-2026-25411 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy