Medium severity · published Apr 12, 2016
CVE-2015-7520
Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x…
6.1
CVSS
5.2%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow remote attackers to inject arbitrary web script or HTML via a crafted "value" attribute in a <input> element.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Wicket · Apache
1.5.0 before 1.5.15; 6.0.0 before 6.22.0; 7.0.0 before 7.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7520
Vendor Advisory
http://wicket.apache.org/news/2016/03/02/cve-2015-7520.html
Third Party Advisory
http://www.securitytracker.com/id/1035166
More from Wicket
9.8
CVE-2024-36522
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation
9.1
CVE-2026-40010
Apache Wicket: possible session fixation using AuthenticatedWebSession
9.1
CVE-2016-6793
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and…
8.8
CVE-2016-6806
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests
7.5
CVE-2026-71257
Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed