Unscored severity · published Aug 29, 2011
CVE-2011-2712
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web…
–
CVSS
3.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wicket · Apache
1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2712
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2712
Vendor Advisory
http://secunia.com/advisories/45727
securityreason.com
http://securityreason.com/securityalert/8357
Vendor Advisory
http://wicket.apache.org/2011/08/23/cve-2011-2712.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/519398/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/49290
www.securitytracker.com
http://www.securitytracker.com/id?1025976
More from Wicket
9.8
CVE-2024-36522
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation
9.1
CVE-2026-40010
Apache Wicket: possible session fixation using AuthenticatedWebSession
9.1
CVE-2016-6793
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and…
8.8
CVE-2016-6806
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests
7.5
CVE-2026-71257
Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed