CVE-2024-53299

The incident concerns CVE-2024-53299 in Apache Wicket. Affects the core of Apache Wicket 7.0.0 on any platform; the vulnerability enables an attacker to cause a denial of service by issuing multiple requests to server resources. The issue is mitigated by upgrading to non-7.x releases (recommended...

CVE-2024-36522

The CVE-2024-36522 issue affects Apache Wicket’s XSLTResourceStream.java default configuration, where processing input from untrusted sources can lead to remote code execution via XSLT injection. Concretely, the vulnerability centers on the default parsing/stream handling path, enabling an attack...

CVE-2024-27439

CVE-2024-27439 affects Apache Wicket. An error in the evaluation of the fetch metadata headers could allow bypassing CSRF protections. The issue is present in Wicket releases 9.1.0 through 9.16.0 and the milestone 10.0 series; Wicket 8.x is not affected. Upgrading to Wicket 9.17.0 or 10.0.0 fixes...

CVE-2020-11976

CVE-2020-11976 describes an information-disclosure vulnerability in Apache Wicket: by using a specially crafted URL an attacker can cause Wicket to deliver unprocessed HTML templates, potentially exposing sensitive data embedded in templates. Affected versions are 7.16.0, 8.8.0, and 9.0.0-M5. The...

CVE-2012-3373

CVE-2012-3373 affects Apache Wicket 1.4.x and 1.5.x. The vulnerability is XSS via a manipulated URL parameter (encoded null byte) in an Ajax link, allowing injection of arbitrary script/HTML in Wicket apps. Root cause: handling of a %00 sequence in the Ajax link URL. Impact: remote attacker can e...

CVE-2021-23937

The CVE-2021-23937 issue is a DNS proxy/amplification vulnerability in Apache Wicket’s WebClientInfo. The root cause is failure to sanitize the X-Forwarded-For header, allowing arbitrary DNS lookups from the server. Affected versions include Wicket 9.x up to 9.2.0 and prior, 8.x up to 8.11.0 and ...

CVE-2015-5347

Apache Wicket is affected by an XSS in the getWindowOpenJavaScript function within ModalWindow (org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow). The vulnerability allows a remote attacker to inject arbitrary script/HTML through the ModalWindow title. Affected versions are 1.5.x p...

CVE-2016-6793

The CVE-2016-6793 entry affects Apache Wicket DiskFileItem in Wicket 6.x (before 6.25.0) and 1.5.x (before 1.5.17). The vulnerability allows remote attackers to cause a denial of service (infinite loop) and to write, move, and delete files with the permissions of DiskFileItem. If run on a Java VM...

CVE-2012-0047

The CVE affects Apache Wicket 1.4.x, vulnerable to XSS via the wicket:pageMapName request parameter. The root cause is improper handling of this parameter, enabling remote script/HTML injection. Affected versions: 1.4.x prior to 1.4.20. The vulnerability is mitigated by upgrading to Apache Wicket...

CVE-2014-3526

Apache Wicket is vulnerable to information disclosure in versions prior to 1.5.12, 6.x prior to 6.17.0, and 7.x prior to 7.0.0-M3. The issue allows remote attackers to obtain sensitive information via identifiers used for storing page markup during temporary user sessions. Connected sources confi...

CVE-2012-1089

CVE-2012-1089 affects Apache Wicket 1.4.x (before 1.4.20) and 1.5.x (before 1.5.5). A directory traversal flaw allows remote attackers to read arbitrary files by using a relative path in a URL for a Wicket resource that corresponds to a null package. The issue impacts web applications using vulne...

CVE-2016-6806

CVE-2016-6806 affects Apache Wicket 6.x prior to 6.25.0, 7.x prior to 7.5.0, and 8.0.0-M1, where CSRF protection could miss some cross-origin requests because only the Origin header was checked. The mitigation is to also validate the Referer header when Origin is absent and ensure all server-side...

CVE-2026-66391

CVE-2026-66391 affects Apache Wicket versions 9.0.0–9.23.0 and 10.0.0–10.9.0, due to a flaw described as Use of Insufficiently Random Values / Protection Mechanism Failure. The issue’s impact is mitigated by upgrading to version 10.10.0, which contains the fix. Connected documents reiterate the a...

CVE-2014-0043

In Apache Wicket, versions 1.5.10 and 6.13.0 are vulnerable to an information-check flaw: by requesting special Wicket URLs, an attacker can determine whether a third-party library with a known vulnerability is present in the classpath. The underlying issue is an information-disclosure-like check...

CVE-2014-7808

CVE-2014-7808 affects Apache Wicket (versions prior to 1.5.13, 6.x prior to 6.19.0, and 7.x prior to 7.0.0-M5). The issue arises from using CryptoMapper as the default encryption provider, which can make it easier for attackers to defeat cryptographic protection and predict encrypted URLs. Remedi...

CVE-2011-2712

CVE-2011-2712 is a cross-site scripting (XSS) vulnerability affecting Apache Wicket 1.4.x prior to 1.4.18 when setAutomaticMultiWindowSupport is enabled. The root cause is the application’s multi-window support configuration enabling injection of arbitrary JavaScript/HTML via unspecified paramete...

CVE-2015-7520

Affected software: Apache Wicket. Vulnerable components: RadioGroup and CheckBoxMultipleChoice classes. Versions impacted: 1.5.x before 1.5.15; 6.x before 6.22.0; 7.x before 7.2.0. Issue: Multiple XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML through a crafted ...

CVE-2013-2055

The CVE-2013-2055 issue affects Apache Wicket versions: 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0. The vulnerability allows remote attackers to read sensitive information by triggering raw HTML templates to render outside wicket:panel markup, causing information disclosure. N...

CVE-2026-43975

CVE-2026-43975 affects Apache Wicket via the FolderUploadsFileManager, which fails to validate or sanitize the uploadFieldId parameter or the clientFileName when constructing file paths. This can let an unauthenticated attacker write files outside the intended upload directory or read files from ...

CVE-2012-5636

CVE-2012-5636 affects Apache Wicket: vulnerable in Wicket 1.4.x < 1.4.22, 1.5.x < 1.5.10, and 6.x < 6.4.0. It is a cross-site scripting (XSS) flaw that could allow remote attackers to inject arbitrary web script or HTML via vectors related to [removed] tags in a rendered response. Connec...

CVE-2026-40010

CVE-2026-40010 describes a session-fixation risk in Apache Wicket caused by missing invocation of Servlet http web request method changeSessionId after session binding. Affected versions are Wicket 8.0.0–8.17.0, 9.0.0, and 10.0.0–10.8.0. The issue can be mitigated by upgrading to version 10.9.0, ...

CVE-2026-42509

The CVE-2026-42509 entry covers an XSS vulnerability in Apache Wicket due to Improper Neutralization of Input During Web Page Generation. Affected versions are Apache Wicket 8.0.0 through 8.17.0, 9.0.0, and 10.0.0 through 10.8.0. The issue’s fix is to upgrade to version 10.9.0, which resolves the...

CVE-2026-43646

CVE-2026-43646 affects Apache Wicket versions 8.0.0–8.17.0, 9.0.0–9.22.0, and 10.0.0–10.8.0. It corresponds to a vulnerability where crafted URLs can bypass PackageResourceGuard, leading to exposure of sensitive information to an unauthorized actor. The recommended fix is upgrading to version 10....

CVE-2026-66390

Apache Wicket contains an XSS vulnerability (CVE-2026-66390) due to improper neutralization of input during web page generation. Affected versions are 9.0.0–9.23.0 and 10.0.0–10.9.0. The issue can be mitigated by upgrading to 10.10.0, which includes the fix. The CVSS 3.1 vector indicates Network ...

CVE-2026-70449

Apache Wicket (versions ≤ 8.18.0, ≤ 9.23.0, ≤ 10.10.0) is vulnerable to a path traversal via improper validation of package resource URL attributes (locale, style, variation). These attributes are spliced into the resource lookup path without checking for path separators, allowing an unauthentica...

CVE-2026-71257

Apache Wicket (versions 8.0.0–8.18.0, 9.0.0–9.23.0, 10.0.0–10.10.0) fails to enforce its per-file size and file count upload limits when the multipart request body has already been consumed by an upstream component (e.g. a servlet with @MultipartConfig , Spring Boot's multipart resolver, or a fil...

CVE-2026-76983

Apache Wicket's AutoLabelTextResolver (registered by default in every WebApplication) writes form-component labels into markup unescaped , never consulting the escape-model-strings setting. When a label is set via FormComponent#setLabel(IModel) with attacker-influenced data, the result is a store...

CVE-2026-76982

Apache Wicket is vulnerable to a cross-site scripting (XSS) issue in the Button component (and its subclasses AjaxButton, AjaxFallbackButton, and WizardButton). The root cause: the Button constructor clears the escape-model-strings flag to prevent double-encoding of the value attribute on elemen...

CVE-2026-71378

Apache Wicket 's ResourceIsolationRequestCycleListener (default policy: FetchMetadataResourceIsolationPolicy) contains a CSRF protection bypass affecting versions 9.1.0–9.23.0 and 10.0.0–10.10.0 . The policy inherited two unsafe allowances from a static-resource reference implementation: (1) all ...

CVE-2026-76984

Apache Wicket 's MetaDataHeaderItem class improperly escapes attribute values when generating and tags. The escape replaced " with \\", but a backslash before a double quote is meaningless in HTML, so an attacker-controlled value containing a double quote breaks out of the attribute and is pars...

CVE-2026-76985

Apache Wicket is affected by a reflected XSS in the Palette component (AbstractOptions). The root cause is that attribute names and values returned by getAdditionalAttributes were written directly into tags without escaping. The vulnerability is only exploitable when an application overrides Pal...

CVE-2026-75802

Apache Wicket (module wicket-extensions ) contains an XSS vulnerability in AjaxEditableLabel , AjaxEditableChoiceLabel , and AjaxEditableMultiLineLabel . The display value obtained from a non-null IChoiceRenderer, and the value returned by the overridden defaultNullLabel(), are written into the l...

CVE-2026-76986

Apache Wicket's AbstractSingleSelectChoice (base class of DropDownChoice ) writes the default option body — rendered when no choice is selected — into markup without escaping , while all other options respect the escape-model-strings setting. The unescaped value originates from the protected meth...