WI
Product
Wicket
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 18Low 0
Watch
Add Wicket to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-36522 | 9.8 | Jul 12 | The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation Affected: 8.0.0 before 8.16.0; 9.0.0 before 9.18.0; 10.0.0; 10.0.0 |
| CVE-2026-40010 | 9.1 | May 6 | Apache Wicket: possible session fixation using AuthenticatedWebSession Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 before 10.9.0 |
| CVE-2016-6793 | 9.1 | Jul 17 | The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and… Affected: 1.5.0 before 1.5.17; 6.0.0 before 6.25.0 |
| CVE-2016-6806 | 8.8 | Oct 3 | Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests Affected: 6.20.0; 6.21.0; 6.22.0; 6.23.0; 6.24.0; 7.0.0; +5 more |
| CVE-2026-71257 | 7.5 | Aug 31 | Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-43646 | 7.5 | May 6 | Apache Wicket: crafted URLs can bypass PackageResourceGuard Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 before 10.9.0 |
| CVE-2021-23937 | 7.5 | May 25 | A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the… Affected: 6.0.0 through 6.2.0; 7.0.0 through 7.17.0; 8.0.0 through 8.11.0; 9.0.0 through 9.2.0 |
| CVE-2020-11976 | 7.5 | Aug 11 | By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates Affected: before 7.17.0; 8.0.0 before 8.9.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +1 more |
| CVE-2014-3526 | 7.5 | Oct 30 | Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing… Affected: 1.5.0 before 1.5.12; 6.0.0; 6.0.0; 6.0.0; 6.0.0; 6.1.0; +20 more |
| CVE-2014-7808 | 7.5 | Sep 15 | Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by… Affected: 1.5.0 before 1.5.13; 6.0.0 before 6.19.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +1 more |
| CVE-2026-66391 | 6.5 | Jul 27 | Apache Wicket: leaked and missing CSP headers Affected: 9.0.0 through 9.23.0; 10.0.0 before 10.10.0 |
| CVE-2026-43975 | 6.5 | May 6 | Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 before 10.9.0 |
| CVE-2024-53299 | 6.5 | Jan 23 | The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources Affected: 7.0.0 through 7.18.0; 8.0.0 through 8.16.0; 9.0.0 before 9.19.0; 10.0.0 before 10.3.0 |
| CVE-2024-27439 | 6.5 | Mar 19 | An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket Affected: 9.1.0 before 9.17.0; 10.0.0; 10.0.0 |
| CVE-2026-76986 | 6.1 | Aug 31 | Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-66390 | 6.1 | Jul 27 | Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence Affected: 9.0.0 through 9.23.0; 10.0.0 before 10.10.0 |
| CVE-2026-42509 | 6.1 | May 6 | Apache Wicket: crafted strings can break out of the JavaScript sequence Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 before 10.9.0 |
| CVE-2012-5636 | 6.1 | Oct 30 | Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +31 more |
| CVE-2015-7520 | 6.1 | Apr 12 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x… Affected: 1.5.0 before 1.5.15; 6.0.0 before 6.22.0; 7.0.0 before 7.2.0 |
| CVE-2015-5347 | 6.1 | Apr 12 | Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before… Affected: 1.5.0 before 1.5.15; 6.0.0 before 6.22.0; 7.0 before 7.2.0 |
| CVE-2026-76985 | 5.4 | Aug 31 | Apache Wicket: XSS in Palette via getAdditionalAttributes Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-76983 | 5.4 | Aug 31 | Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-76984 | 5.4 | Aug 31 | Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-76982 | 5.4 | Aug 31 | Apache Wicket: XSS in Button via its model object Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-75802 | 5.4 | Aug 31 | Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-70449 | 5.3 | Aug 31 | Apache Wicket: Path traversal in resource style/variation/locale Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2014-0043 | 5.3 | Oct 3 | In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus… Affected: 1.5.10; 6.13.0 |
| CVE-2026-71378 | 4.6 | Aug 31 | Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener Affected: 9.1.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2013-2055 | – | Feb 10 | Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that… Affected: 1.4.0; 1.4.1; 1.4.10; 1.4.11; 1.4.12; 1.4.13; +29 more |
| CVE-2012-3373 | – | Sep 19 | Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors… Affected: 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; 1.4.6; +22 more |
| CVE-2012-1089 | – | Mar 23 | Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +19 more |
| CVE-2012-0047 | – | Mar 23 | Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +14 more |
| CVE-2011-2712 | – | Aug 29 | Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +12 more |
Showing 33