Wicket (Apache) - vulnerabilities (CVEs)

33 CVEs, 0 in the last 30 days, 275 known versions, newest CVE from 2026-08-31. Vendor: Apache.

CVEs of Wicket

• CVE-2026-76986 - CVSS 6.1 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of…
• CVE-2026-76985 - CVSS 5.4 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions,…
• CVE-2026-76983 - CVSS 5.4 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by…
• CVE-2026-76984 - CVSS 5.4 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link>…
• CVE-2026-76982 - CVSS 5.4 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag…
• CVE-2026-75802 - CVSS 5.4 (medium), 2026-08-31: AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the…
• CVE-2026-71378 - CVSS 4.6 (medium), 2026-08-31: ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy…
• CVE-2026-71257 - CVSS 7.5 (high), 2026-08-31: Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request…
• CVE-2026-70449 - CVSS 5.3 (medium), 2026-08-31: Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including…
• CVE-2026-66391 - CVSS 6.5 (medium), 2026-07-27: Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0,…
• CVE-2026-66390 - CVSS 6.1 (medium), 2026-07-27: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from…
• CVE-2026-43646 - CVSS 7.5 (high), 2026-05-06: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from…
• CVE-2026-43975 - CVSS 6.5 (medium), 2026-05-06: FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths,…
• CVE-2026-42509 - CVSS 6.1 (medium), 2026-05-06: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from…
• CVE-2026-40010 - CVSS 9.1 (critical), 2026-05-06: Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.…
• CVE-2024-53299 - CVSS 6.5 (medium), 2025-01-23: The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users…
• CVE-2024-36522 - CVSS 9.8 (critical), 2024-07-12: The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source…
• CVE-2024-27439 - CVSS 6.5 (medium), 2024-03-19: An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from…
• CVE-2021-23937 - CVSS 7.5 (high), 2021-05-25: A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the…
• CVE-2020-11976 - CVSS 7.5 (high), 2020-08-11: By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information…
• CVE-2012-5636 - CVSS 6.1 (medium), 2017-10-30: Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to…
• CVE-2014-3526 - CVSS 7.5 (high), 2017-10-30: Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving…
• CVE-2016-6806 - CVSS 8.8 (high), 2017-10-03: Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The…
• CVE-2014-0043 - CVSS 5.3 (medium), 2017-10-03: In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in…
• CVE-2014-7808 - CVSS 7.5 (high), 2017-09-15: Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and…
• CVE-2016-6793 - CVSS 9.1 (critical), 2017-07-17: The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and…
• CVE-2015-7520 - CVSS 6.1 (medium), 2016-04-12: Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x…
• CVE-2015-5347 - CVSS 6.1 (medium), 2016-04-12: Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache…
• CVE-2013-2055 - CVSS 5 (medium), 2014-02-10: Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive…
• CVE-2012-3373 - CVSS 4.3 (medium), 2012-09-19: Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or…
• CVE-2012-0047 - CVSS 4.3 (medium), 2012-03-23: Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the…
• CVE-2012-1089 - CVSS 5 (medium), 2012-03-23: Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files…
• CVE-2011-2712 - CVSS 2.6 (low), 2011-08-29: Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to…