Threats tagged 'ghsa-f4x7-9w8x-8x82'

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 contain an input neutralization vulnerability during web page generation. The framework improperly escapes component markup IDs and input names when embedding them in JavaScript string literals, allowing injection of script code if these IDs contain certain special characters. This can lead to cross-site scripting (XSS) attacks. The issue is fixed by rejecting dangerous characters in IDs starting from versions 8.20.0, 9.25.0, and 10.12.0.