cbcvebase.

Apache Sling Xss Protection Api vulnerabilities

6 known vulnerabilities affecting apache/sling_xss_protection_api.

Total CVEs
6
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM6

Vulnerabilities

Page 1 of 1
CVE-2026-92001P4MEDIUMCVSS 6.1fixed in 2.4.122026-09-23
CVE-2026-92001 [MEDIUM] CWE-776 CVE-2026-92001: Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability i Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
nvd
CVE-2017-15717P4MEDIUMCVSS 6.1≤ 1.0.18v2.0.02018-01-10
CVE-2017-15717 [MEDIUM] CWE-79 CVE-2017-15717: A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidH A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compa
nvd
CVE-2026-73192P4MEDIUMCVSS 6.1fixed in 2.4.122026-09-23
CVE-2026-73192 [MEDIUM] CWE-79 CVE-2026-73192: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vul An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an applicati
nvd
CVE-2026-91852P4MEDIUMCVSS 6.1fixed in 2.4.122026-09-23
CVE-2026-91852 [MEDIUM] CWE-79 CVE-2026-91852: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
nvd
CVE-2026-91999P4MEDIUMCVSS 6.1fixed in 2.4.122026-09-23
CVE-2026-91999 [MEDIUM] CWE-79 CVE-2026-91999: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
nvd
CVE-2026-91928P4MEDIUMCVSS 6.1fixed in 2.4.122026-09-23
CVE-2026-91928 [MEDIUM] CWE-79 CVE-2026-91928: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
nvd
Apache Sling Xss Protection Api vulnerabilities | cvebase