Cross-site Scripting (XSS)

Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the getValidHref function. An attacker can execute arbitrary...

PT-2026-97253

Name of the Vulnerable Software and Affected Versions Apache Sling XSS versions prior to 2.4.12 Description Improper neutralization of input during web page generation allows for a reflected cross-site scripting XSS attack. This occurs when using the getValidHref function within the XSSAPI class,...

CVE-2018-4876: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPIgetValidHref function...

Adobe Experience Manager 'Sling XSSAPI#getValidHref' function cross-site scripting vulnerability

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2017-15717: Improper Neutralization of Input During Web Page Generation

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImplgetValidHref and org.apache.sling.xss.impl.XSSFilterImplisValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API...