CVE-2012-3373

CVE-2012-3373 affects Apache Wicket 1.4.x and 1.5.x. The vulnerability is XSS via a manipulated URL parameter (encoded null byte) in an Ajax link, allowing injection of arbitrary script/HTML in Wicket apps. Root cause: handling of a %00 sequence in the Ajax link URL. Impact: remote attacker can e...

CVE-2012-0047

The CVE affects Apache Wicket 1.4.x, vulnerable to XSS via the wicket:pageMapName request parameter. The root cause is improper handling of this parameter, enabling remote script/HTML injection. Affected versions: 1.4.x prior to 1.4.20. The vulnerability is mitigated by upgrading to Apache Wicket...

CVE-2026-71378

Apache Wicket 's ResourceIsolationRequestCycleListener (default policy: FetchMetadataResourceIsolationPolicy) contains a CSRF protection bypass affecting versions 9.1.0–9.23.0 and 10.0.0–10.10.0 . The policy inherited two unsafe allowances from a static-resource reference implementation: (1) all ...