← Back to browse · API

CVE-2024-36522

Severity
CRITICAL
CVSS
9.8
EPSS
0.02127
Risk score
39.94
CISA KEV
No
PoC
No
Published
2024-07-12
Modified
2025-02-13
First seen
2026-08-07
Aliases
EUVD-2024-2364, GHSA-HHWC-GH8H-9RRP
Products
Apache Software Foundation:Apache Wicket 10.0.0-M1 ≤10.0.0, Apache Software Foundation:Apache Wicket 8.0.0 ≤8.15.0, Apache Software Foundation:Apache Wicket 9.0.0 ≤9.17.0
Sources
euvd EUVD-2024-2364

Description

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.

References