Apache ActiveMQ versions before 5.19.6 and from 6.0.0 before 6.2.5 contain a cross-site scripting (XSS) vulnerability in the web console. An authenticated attacker can inject malicious HTML content by overriding the content type and injecting HTML into a JMS selector field, potentially leading to script execution in the user's browser. The issue is fixed in versions 5.19.6 and 6.2.5.