CVE-2026-48910mediumCWE-80

CVE-2026-48910: falha de média gravidade em Apache JSPWiki

Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing

Publicada em

Seguir esta CVE+ Monitorar Apache JSPWiki

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.6%
A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWiki: through 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
Apache Software Foundation · Apache JSPWiki
CVEs relacionadas — Apache JSPWiki

No mesmo produto, das mais perigosas para as menos.

CVE-2022-28730—Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jspEPSS 86.2%CVE-2022-27166—XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2EPSS 86.2%CVE-2022-28732—Apache JSPWiki Cross-site scripting vulnerability on WeblogPluginEPSS 82.8%CVE-2024-27136MEDIUMApache JSPWiki: Cross-site scripting vulnerability on upload pageEPSS 60.8%CVE-2022-28731—Apache JSPWiki CSRF in UserPreferences.jspEPSS 58.7%CVE-2021-44140—Arbitrary file deletion on logoutEPSS 6.4%