EUVD-2026-49372
GHSA-c536-hcqf-3r28
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Cross-site scripting (XSS) in Apache Wicket versions 9.0.0-9.23.0 and 10.0.0-10.9.0 allows attackers to inject client-side scripts into pages rendered by the affected application, potentially compromising user sessions or redirecting victims. The vulnerability arises from insufficient neutralization of user input during HTML generation, enabling script injection via crafted URLs or form submissions. No public exploit is known, but upgrading to version 10.10.0 eliminates the issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Apache Wicket gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0.
Users are recommended to upgrade to version 10.10.0, which fixes the issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Apache Wicket
View allPath traversal vulnerability in Apache Wicket's FolderUploadsFileManager allows unauthenticated attackers to read arbitr
Apache Wicket's form-less upload endpoint (AbstractFileUploadResource, the server side of FileUploadToResourceField, or
Heap-exhaustion denial of service in Apache Wicket 9.14.0 through 9.24.0 and 10.0.0 through 10.11.0, reachable without a
Cross-site scripting in Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 allows text
Cross-site scripting in Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 lets a value
Stored cross-site scripting in Apache Wicket's AjaxNewWindowNotifyingBehavior allows a client-supplied browser window na
Cross-site scripting in Apache Wicket 8.0.0 through 8.19.0 lets remote attackers get script executed in the application'
Apache Wicket's public JavaScriptUtils.escapeQuotes() helper fails to escape backslashes before quotes, so attacker-infl
Cross-site scripting in Apache Wicket's SmartLinkLabel and SmartLinkMultiLineLabel components turns attacker-influenced
Session fixation in Apache Wicket's role-based authentication module leaves the container session id unchanged when an a
Missing authorization in Apache Wicket 8.x, 9.x and 10.x allows unauthenticated remote attackers to invoke a component's
Missing authorization in Apache Wicket 10.3.0 through 10.11.0 allows a remote unauthenticated caller to invoke the serve
Exploit-DB