CVE-2020-11976

CVE-2020-11976 describes an information-disclosure vulnerability in Apache Wicket: by using a specially crafted URL an attacker can cause Wicket to deliver unprocessed HTML templates, potentially exposing sensitive data embedded in templates. Affected versions are 7.16.0, 8.8.0, and 9.0.0-M5. The...

CVE-2021-23937

The CVE-2021-23937 issue is a DNS proxy/amplification vulnerability in Apache Wicket’s WebClientInfo. The root cause is failure to sanitize the X-Forwarded-For header, allowing arbitrary DNS lookups from the server. Affected versions include Wicket 9.x up to 9.2.0 and prior, 8.x up to 8.11.0 and ...

CVE-2014-3526

Apache Wicket is vulnerable to information disclosure in versions prior to 1.5.12, 6.x prior to 6.17.0, and 7.x prior to 7.0.0-M3. The issue allows remote attackers to obtain sensitive information via identifiers used for storing page markup during temporary user sessions. Connected sources confi...

CVE-2014-7808

CVE-2014-7808 affects Apache Wicket (versions prior to 1.5.13, 6.x prior to 6.19.0, and 7.x prior to 7.0.0-M5). The issue arises from using CryptoMapper as the default encryption provider, which can make it easier for attackers to defeat cryptographic protection and predict encrypted URLs. Remedi...

CVE-2026-43646

CVE-2026-43646 affects Apache Wicket versions 8.0.0–8.17.0, 9.0.0–9.22.0, and 10.0.0–10.8.0. It corresponds to a vulnerability where crafted URLs can bypass PackageResourceGuard, leading to exposure of sensitive information to an unauthorized actor. The recommended fix is upgrading to version 10....

CVE-2026-71257

Apache Wicket (versions 8.0.0–8.18.0, 9.0.0–9.23.0, 10.0.0–10.10.0) fails to enforce its per-file size and file count upload limits when the multipart request body has already been consumed by an upstream component (e.g. a servlet with @MultipartConfig , Spring Boot's multipart resolver, or a fil...