VUL4J-23

Apache Sling Bringing Back the Fun! Apache Sling is a web framework that uses a Java Content Repository, such as Apache Jackrabbit, to store and manage content. Sling applications use either scripts or Java servlets, selected based on simple name conventions, to process HTTP requests in a RESTful...

apache__sling-org-apache-sling-servlets-resolver_CVE-2024-23673_2-10-0

Apache Sling Servlet Resolver This module is part of the Apache Sling project. Bundle implementing the Sling API ServletResolver. See the servlets and scripts documentation for how this works...

apache__sling-org-apache-sling-xss_CVE-2016-5394_1-0-8

Apache Sling XSS Bundle The Apache Sling XSS Bundle provides two services for escaping and filtering XSS-prone user submitted content: 1. org.apache.sling.xss.XSSAPI 2. org.apache.sling.xss.XSSFilter Please check the JavaDoc of each service to find out what methods they provide...

CVE-2026-123765

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. xssAPI.getStyleToken accepts markup in unquoted urls. This issue affects Apache Sling XSS: before 2.4.14. Users are recommended to upgrade to version 2.4.14, which fixes the issue...

CVE-2026-123765 Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. xssAPI.getStyleToken accepts markup in unquoted urls. This issue affects Apache Sling XSS: before 2.4.14. Users are recommended to upgrade to version 2.4.14, which fixes the issue...

CVE-2026-123765

Apache Sling XSS versions before 2.4.14 are vulnerable to a cross-site scripting (XSS) issue caused by the improper neutralization of input during web page generation. The vulnerability exists because the xssAPI.getStyleToken() function accepts markup within unquoted URLs . To remediate this issu...

EUVD-2026-124338

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. xssAPI.getStyleToken accepts markup in unquoted urls. This issue affects Apache Sling XSS: before 2.4.14. Users are recommended to upgrade to version 2.4.14, which fixes the issue...

CVE-2026-103866

A flaw was found in Apache Sling Engine. A remote attacker could perform HTTP request smuggling by sending specially crafted requests containing non-standard percent-encoded characters or invalid character sets. Because the query and form parser continues processing requests despite encountering...

CVE-2026-103863

A flaw was found in Apache Sling Engine. This vulnerability allows an attacker to conduct stored Cross-Site Scripting XSS attacks by evading security header protections. Included components can bypass header and content-type enforcement mechanisms through manipulated response headers, character s...

CVE-2026-103864

Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue...

CVE-2026-103866

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before...

CVE-2026-103863

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader, repeated calls to...

CVE-2026-103866

A flaw in the Apache Sling Engine query/form parser allows for HTTP Request/Response smuggling (CWE-444, CWE-436). The vulnerability occurs because the parser accepts non-standard percent-escapes and invalid character sets, continuing to process requests even after encountering these errors. This...

EUVD-2026-117433

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before...

CVE-2026-103866 Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before...

CVE-2026-103866 Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before...

CVE-2026-103864

Apache Sling Engine versions before 3.0.4 are vulnerable to an improper output neutralization for logs (CWE-117). The root cause involves request-derived values reaching log sinks without proper CR/LF neutralization . This issue can impact the integrity of log files. Numerous packages, including ...

EUVD-2026-117432

Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue...

CVE-2026-103864 Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue...

CVE-2026-103864 Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue...