Cross-site Scripting

Apache Wicket is vulnerable to Cross-site Scripting. The vulnerability is due to improper escaping of attribute values in MetaDataHeaderItem, where double quotes in attribute values are replaced with " which has no effect in HTML, and an attacker can supply a value containing a double quote via...