Apache Wicket vulnerabilities

33 CVEs affecting Apache Wicket, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76986, published 2026-08-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-6793, published 2017-07-17. Critical severity, CVSS 9.1. EPSS: 8.5% chance of exploitation in the next 30 days. The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the…
CVE-2015-5347, published 2016-04-12. Medium severity, CVSS 6.1. EPSS: 8.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before 1.5.15, 6.x before…
CVE-2012-1089, published 2012-03-23. Medium severity, CVSS 5.0. EPSS: 5.4% chance of exploitation in the next 30 days. Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a…
CVE-2015-7520, published 2016-04-12. Medium severity, CVSS 6.1. EPSS: 5.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow…
CVE-2021-23937, published 2021-05-25. High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days. A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is…
CVE-2020-11976, published 2020-08-11. High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days. By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually…
CVE-2012-5636, published 2017-10-30. Medium severity, CVSS 6.1. EPSS: 3.5% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via…
CVE-2011-2712, published 2011-08-29. Low severity, CVSS 2.6. EPSS: 3.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via…
CVE-2012-3373, published 2012-09-19. Medium severity, CVSS 4.3. EPSS: 3.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00…
CVE-2013-2055, published 2014-02-10. Medium severity, CVSS 5.0. EPSS: 3.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML…

Latest

CVE-2026-76986, published 2026-08-31. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the…
CVE-2026-76985, published 2026-08-31. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a…
CVE-2026-76984, published 2026-08-31. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names…
CVE-2026-76983, published 2026-08-31. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by…
CVE-2026-76982, published 2026-08-31. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value…
CVE-2026-75802, published 2026-08-31. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML…
CVE-2026-71378, published 2026-08-31. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its…
CVE-2026-71257, published 2026-08-31. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request body has already been consumed by…
CVE-2026-70449, published 2026-08-31. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet…
CVE-2026-66391, published 2026-07-27. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are…