{"cve":{"cve_id":"CVE-2025-26865","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.00623,"epss_percentile":0.45161,"epss_as_of":"2026-06-23","description":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: from 18.12.17 before 18.12.18.  \n\nIt's a regression between 18.12.17 and 18.12.18.\nIn case you use something like that, which is not recommended!\nFor security, only official releases should be used.\n\nIn other words, if you use 18.12.17 you are still safe.\nThe version 18.12.17 is not a affected.\nBut something between 18.12.17 and 18.12.18 is.\n\nIn that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.","published_at":"2025-03-10T14:01:06.952000Z","last_modified_at":null,"cvss_v3_score":3.5,"cvss_v3_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_v3_severity":"LOW","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":null,"ssvc_automatable":null,"ssvc_technical_impact":null,"cwes":["CWE-1336"],"nvd_references":["https://ofbiz.apache.org/download.html","https://ofbiz.apache.org/security.html","https://issues.apache.org/jira/browse/OFBIZ-12594","https://lists.apache.org/thread/prb48ztk01bflyyjbl6p56wlcc1n5sz7"],"vuln_status":null,"trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-06-24T00:09:39.878444Z","updated_at":"2026-06-28T23:26:05.505565Z"},"effective_severity":"LOW","badges":[],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"P","value_label":"Physical"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"L","value_label":"Low"},{"metric":"I","name":"Integrity","value":"L","value_label":"Low"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"apache-software-foundation","vendor_name":"Apache Software Foundation","product_slug":"apache-ofbiz","product_name":"Apache OFBiz","version_start":"18.12.17","version_start_inclusive":true,"version_end":"18.12.18","version_end_inclusive":false,"cpe23_uri":"cve5:apache-software-foundation:apache-ofbiz:18.12.17:18.12.18"}],"exploit_refs":[],"news":[],"references":[{"url":"https://ofbiz.apache.org/download.html","source_type":"MISC","tags":[]},{"url":"https://ofbiz.apache.org/security.html","source_type":"MISC","tags":[]},{"url":"https://issues.apache.org/jira/browse/OFBIZ-12594","source_type":"MISC","tags":[]},{"url":"https://lists.apache.org/thread/prb48ztk01bflyyjbl6p56wlcc1n5sz7","source_type":"MAILING_LIST","tags":["mailing-list"]}],"timeline":[{"type":"published","at":"2025-03-10T14:01:06.952000Z","label":"CVE published","source":null},{"type":"cvss_changed","at":"2026-06-28T17:44:03.799523Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-06-28T17:44:03.799523Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-06-28T17:44:03.799523Z","label":"CVSS score revised","source":"cvelistv5"}]}