Apache Sling XSS vulnerabilities
5 known CVE vulnerabilities in Apache Sling XSS, translated and rated.
- CVE-2026-92001Unknown
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-91999Unknown
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-91928Unknown
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-91852Unknown
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-73192Unknown
A reflected cross-site scripting (CWE-79) vulnerability in Apache Sling XSS version 2.4.10 and prior, caused by improper neutralization of input in the XSSAPI.getValidHref() method. An attacker can submit an unsanitized value, allowing script execution in the victim's browser in every feature using this method.