EUVD-2026-114903

Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built fr...

EUVD-2026-114904

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CVE-2026-95863

Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built fr...

CVE-2026-111089

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

CVE-2026-111089

Apache Wicket versions 8.0.0 through 8.19.0 , 9.0.0 through 9.24.0 , and 10.0.0 through 10.11.0 are vulnerable to Cross-Site Scripting (XSS) . The root cause is the framework's failure to escape resource bundle texts (such as localized labels or CSS class names) when they are written into generat...

CVE-2026-111089 Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

CVE-2026-95863

Apache Wicket is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The software fails to escape markup IDs and component IDs when they are written into generated JavaScript string literals. This allows an attacker to break out of the lite...

CVE-2026-95863 Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup

Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built fr...

CVE-2026-84172 Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...

CVE-2026-84172

Apache Wicket is vulnerable to a file disclosure issue where component markup is served as a package resource. The root cause lies in org.apache.wicket.markup.html.PackageResourceGuard; when wicket-core is loaded by a class loader that cannot see the application's classes (e.g., in shared library...

PT-2026-135054

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

CVE-2026-95863: Apache Software Foundation Apache Wicket: Improper neutralization of input during web page generation in Apache Wicket

Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built fr...

CVE-2026-111089: Apache Software Foundation Apache Wicket: Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes…

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

PT-2026-135057

Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built fr...

Unauthenticated Arbitrary File Disclosure

org.apache.wicket, wicket-core is vulnerable to an unauthenticated arbitrary file disclosure. The vulnerability is due to improper validation of attacker-controlled locale, style, and variation URL attributes before they are appended to the resource path, which allows an attacker to use path...

Improper Neutralization Of Input During Web Page Generation

org.apache.wicket, wicket-core is vulnerable to improper neutralization of input during web page generation. The vulnerability is due to the resolver rendering attacker-influenced label values without escaping, which allows an attacker to inject malicious markup or script content into a web page...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.0.1-rc, <=3.1.7) +379 more potentially affected by CVE-2026-71257 via org.apache.wicket:wicket-core (>=9.0.0-m1, <=9.23.0)

org.apache.wicket:wicket-core MAVEN version =9.0.0-m1, =1.3.1.release, =3.0.1-rc, =3.0.1-rc, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.18.0, =9.0.0-m2, =9.0.0-m3, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.23.1 and more Source cves: CVE-2026-71257https:/...