PT-2026-83795
CVE-2026-76983
·
تاريخ النشر
2026-08-31
·
تاريخ التحديث
2026-09-01
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Apache Wicket versions 1.5.0 through 8.18.0
Apache Wicket versions 9.0.0 through 9.23.0
Apache Wicket versions 10.0.0 through 10.10.0
Description
Improper neutralization of input during web page generation occurs via the
<wicket:label> tag provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver. The resolver writes labels into the markup without escaping, causing any markup within a label to be rendered as active markup. This occurs when the label of a form component, set through FormComponent#setLabel(IModel), contains data that can be influenced by an attacker.Recommendations
Upgrade to version 8.19.0
Upgrade to version 9.24.0
Upgrade to version 10.11.0
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾