Exposição de Apache Wicket

Web frameworks
70
score de exposição
1.926
sites usam
0
em exploração
2
críticos
Análise Vexday

Apache Wicket apresenta um histórico de vulnerabilidades relativamente contido, com 11 CVEs catalogadas e taxa de exploração ativa abaixo da média geral do catálogo, sem registros no CISA KEV. Ainda assim, merecem atenção os dois registros de severidade crítica e, em especial, o volume de quatro novas vulnerabilidades surgidas nos últimos 90 dias, o que indica atividade recente de descoberta que deve ser monitorada. A falha mais prevalente segue o padrão CWE-200, relacionado à exposição indevida de informações, sugerindo que controles de acesso e gerenciamento de dados sensíveis no framework requerem revisão cuidadosa. A CVE mais perigosa atualmente ativa, CVE-2021-23937, registra EPSS de 0,0426, indicando probabilidade de exploração ainda moderada, mas não desprezível para ambientes expostos.

CVEs

41 resultados
CVE-2026-42509MEDIUMApache Wicket: crafted strings can break out of the JavaScript sequenceEPSS 0.4%CVE-2026-84170HIGHApache Wicket: Configured upload limits are not enforced by the standalone file upload resourceEPSS 0.3%CVE-2026-82705MEDIUMApache Wicket: The configured authorization strategy is not applied to an IResource embedded in a componentEPSS 0.3%CVE-2026-82115MEDIUMApache Wicket: The configured authorization strategy is not applied to a shared WebSocketResourceEPSS 0.3%CVE-2026-111089HIGHApache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupEPSS 0.3%CVE-2026-95863HIGHApache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupEPSS 0.3%CVE-2026-84231HIGHApache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagEPSS 0.3%CVE-2026-82898LOWApache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs inEPSS 0.3%CVE-2026-82956HIGHApache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameEPSS 0.3%CVE-2026-83539HIGHApache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model dataEPSS 0.3%CVE-2026-82840HIGHApache Wicket: The session id is renewed only on the first sign in, not on re-authenticationEPSS 0.3%CVE-2026-82557MEDIUMApache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submissionEPSS 0.3%CVE-2026-83594HIGHApache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesEPSS 0.3%CVE-2026-83559HIGHApache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalEPSS 0.3%CVE-2026-82558LOWApache Wicket: WebSocketBehavior delivers client messages to a component the client may not invokeEPSS 0.3%CVE-2026-82559LOWApache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationEPSS 0.3%CVE-2026-84177MEDIUMApache Wicket: A component's markup is served as a package resource when its class name contains an underscoreEPSS 0.3%CVE-2026-87718LOWApache Wicket: CSP headers silently omitted for pages served through nested request handler delegatesEPSS 0.3%CVE-2026-84172MEDIUMApache Wicket: Component markup is served as a package resource when wicket-core has its own class loaderEPSS 0.3%CVE-2026-82704MEDIUMApache Wicket: A listener is invoked on a page instance the request itself created and never configuredEPSS 0.3%