Apache ActiveMQ versions before 5.19.6 and from 6.0.0 before 6.2.5 contain a code injection vulnerability via the admin web console. An authenticated attacker can craft a malicious broker name that bypasses validation, leading to loading a remote Spring XML application and arbitrary code execution on the broker's JVM. Upgrading to versions 5.19.6 or 6.2.5 mitigates this issue.