CVE Feed

    Dashboard / CVE / CVE-2015-7520

    CVE-2015-7520

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow remote attackers to inject arbitrary web script or HTML via a crafted "value" attribute in a <input> element.

    Published:Apr 12, 2016
    Last Modified:Apr 12, 2025
    EPS:Apr 12, 2016
    EPSS Score:0.01397
    CVSS Score:6.1

    Affected Products

    Vendor
    Apache
    Product
    Wicket

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-76986 (CVSS 6.1) — Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.f…
    CVE-2026-76985 (CVSS 5.1) — Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.ma…
    CVE-2026-76983 (CVSS 5.1) — Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provi…
    CVE-2026-76984 (CVSS 5.1) — Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.M…
    CVE-2026-76982 (CVSS 5.1) — Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.f…
    CVE-2026-75802 (CVSS 5.1) — AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the dis…
    CVE-2026-71378 (CVSS 4.6) — ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by reje…
    CVE-2026-71257 (CVSS 7.5) — Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart reques…
    CVE-2026-70449 (CVSS 5.3) — Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to r…
    CVE-2026-66391 (CVSS 6.5) — Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High