CVE Feed

    Dashboard / CVE / CVE-2012-5636

    CVE-2012-5636

    Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script> tags in a rendered response.

    Published:Oct 30, 2017
    Last Modified:Apr 20, 2025
    EPS:Oct 30, 2017
    EPSS Score:0.01201
    CVSS Score:6.1

    Affected Products

    Vendor
    Apache
    Product
    Wicket

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-76986 (CVSS 6.1) — Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.f…
    CVE-2026-76985 (CVSS 5.1) — Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.ma…
    CVE-2026-76983 (CVSS 5.1) — Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provi…
    CVE-2026-76984 (CVSS 5.1) — Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.M…
    CVE-2026-76982 (CVSS 5.1) — Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.f…
    CVE-2026-75802 (CVSS 5.1) — AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the dis…
    CVE-2026-71378 (CVSS 4.6) — ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by reje…
    CVE-2026-71257 (CVSS 7.5) — Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart reques…
    CVE-2026-70449 (CVSS 5.3) — Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to r…
    CVE-2026-66391 (CVSS 6.5) — Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High