EUVD-2026-68517

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every...

CVE-2026-76986 Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every...

CVE-2026-76986

Apache Wicket's AbstractSingleSelectChoice (base class of DropDownChoice ) writes the default option body — rendered when no choice is selected — into markup without escaping , while all other options respect the escape-model-strings setting. The unescaped value originates from the protected meth...

EUVD-2026-68516

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings...

CVE-2026-76982

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

CVE-2026-76983

Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no...

CVE-2026-75802

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

CVE-2026-76983

Apache Wicket's AutoLabelTextResolver (registered by default in every WebApplication) writes form-component labels into markup unescaped , never consulting the escape-model-strings setting. When a label is set via FormComponent#setLabel(IModel) with attacker-influenced data, the result is a store...

EUVD-2026-68491

Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no...

CVE-2026-76983 Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel

Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no...

CVE-2026-76982 Apache Wicket: XSS in Button via its model object

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

EUVD-2026-68489

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — ComponentTag already encodes attribute values when it write...

EUVD-2026-68488

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

CVE-2026-75802

Apache Wicket (module wicket-extensions ) contains an XSS vulnerability in AjaxEditableLabel , AjaxEditableChoiceLabel , and AjaxEditableMultiLineLabel . The display value obtained from a non-null IChoiceRenderer, and the value returned by the overridden defaultNullLabel(), are written into the l...

CVE-2026-38192

pluck-CMS-4.7.20-code-injection-vulnerability In admin.php, the moduleaddtosite function iterates through the entire $POST array, splits the user-controllable parameter names using explode'|', ... and directly concatenates them into data/settings/themes//moduleconf.php. This file will subsequentl...

CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 취약점 유형: 크로스 사이트 스크립팅XSS – 반사형 XSS CWE: CWE-79 – 웹 페이지 생성 중 입력의 부적절한 중화'크로스 사이트 스크립팅' 심각도: 높음 CISA ADP CVSS v3.1: 7.1 개요 CVE-2026-9833은 2.2.0 버전 이전의 Tag Groups – Advanced Way to Display Your Taxonomy Terms WordPress 플러그인에 영향을 미칩니다. 이 취약점은 플러그인의 AJAX 매개변수 중 하나가 제...

CVE-2026-48732-poc

CVE-2026-48732: Warp Remote SSH cwd Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-48732 , a high severity OS Command Injection vulnerability in Warp legacy SSH background command handling. Affected Warp versions used the remote working directory cw...

CVE-2026-42568

CVE-2026-42568 — YAMCS LDAP Injection in LdapAuthModule Summary An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule. The username parameter is inserted directly into LDAP search filters without RFC 4515 escaping, allowing authentication bypass...

CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

Stored Cross-site Scripting vulnerability in ash-project ashadmin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField...

CVE-2026-77850

Stored XSS in ash-project's ash_admin (versions 0.13.0 before 1.3.1 ) allows lower-privileged users to execute arbitrary JavaScript in an administrator's browser. The root cause lies in the relationship typeahead components RelationshipField and ManagedRelationshipSelectField , which highlight ma...