Apache OFBiz is vulnerable to reflected cross‑site scripting because certain modal dialog parameters are not properly HTML attribute escaped. As a result, an attacker can cause a victim’s browser to execute arbitrary JavaScript when a crafted URL is accessed, potentially exposing session data or enabling drive‑by attacks. The weakness falls under CWE‑79.

The vulnerability affects all deployments of Apache OFBiz older than version 24.09.06. No specific sub‑products are listed separately; the issue is present across the application before that release.

With a CVSS score of 6.1, the vulnerability is considered moderate. The EPSS score of < 1% indicates a low likelihood of exploitation in the wild. It is still not listed in the CISA KEV catalog. The flaw can be exploited via the web interface, requiring an attacker to craft a malicious URL that a victim will click or be tricked into visiting. Because it is a reflected XSS, the impact includes execution of arbitrary JavaScript in the victim's browser, potentially leading to session hijacking or similar attacks.