Non notée
CVE-2026-42509 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Wicket 10.0 | 10.0.0 → 10.8.0 | Pas de correctif indiqué |
| Apache Wicket 9.0 | 9.0.0 → 9.22.0 | Pas de correctif indiqué |
| Apache Wicket 8.0 | 8.0.0 → 8.17.0 | Pas de correctif indiqué |
Autres CVE de Apache Wicket
Les 40 CVE de Apache Wicket →
CVE-2026-111089
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
7.6
Élevée
CVE-2026-95863
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
7.6
Élevée
CVE-2026-87718
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
2.3
Faible
CVE-2026-84231
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
7.4
Élevée