EUVD-2026-49372
GHSA-c536-hcqf-3r28
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0.
Users are recommended to upgrade to version 10.10.0, which fixes the issue.
AnalysisAI
Cross-site scripting (XSS) in Apache Wicket versions 9.0.0-9.23.0 and 10.0.0-10.9.0 allows attackers to inject client-side scripts into pages rendered by the affected application, potentially compromising user sessions or redirecting victims. The vulnerability arises from insufficient neutralization of user input during HTML generation, enabling script injection via crafted URLs or form submissions. No public exploit is known, but upgrading to version 10.10.0 eliminates the issue.
More in Apache Wicket
View allUnauthenticated remote attackers can partially read and modify data in Apache Wicket versions 9.0.0 through 9.23.0 and 1
Path traversal vulnerability in Apache Wicket's FolderUploadsFileManager allows unauthenticated attackers to read arbitr
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today