GCVE - cpe:2.3:a:apache:wicket:1.5.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:wicket:1.5.0:*:*:*:*:*:*:*

part: a version: 1.5.0 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Wicket (`47617a88-095f-5d07-871a-faa63ba3b71d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/wicket`	purl2cpe	2026-06-01 10:14:30.303836
`pkg:github/apache/wicket`	purl2cpe	2026-06-01 10:14:30.303838
`pkg:maven/org.apache.wicket/wicket-core`	purl2cpe	2026-06-01 10:14:30.303839
`pkg:sourceforge/wicket`	purl2cpe	2026-06-01 10:14:30.303840

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-2055`	vulnerable	2026-06-08 05:03:58.149241	Details available Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML templates to be rendered without being processed and reading the information that is outside of wicket:panel markup. Published: 2014-02-10T23:00:00.000Z Updated: 2024-08-06T15:20:37.447Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2014/Feb/38 https://wicket.apache.org/2014/02/06/cve-2013-2055.html http://osvdb.org/102955 https://wicket.apache.org/2013/05/17/wicket-6.8.0-released.html http://www.securityfocus.com/bid/65431	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5636`	vulnerable	2026-06-08 05:02:57.645674	Details available Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script> tags in a rendered response. Published: 2017-10-30T19:00:00.000Z Updated: 2024-08-06T21:14:16.232Z Open on db.gcve.eu Reference links https://wicket.apache.org/news/2013/03/03/cve-2012-5636.html http://www.securityfocus.com/bid/101644	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3373`	vulnerable	2026-06-08 05:02:09.405621	Details available Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app. Published: 2012-09-19T19:00:00.000Z Updated: 2024-08-06T20:05:11.642Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/55445 http://secunia.com/advisories/50555 https://exchange.xforce.ibmcloud.com/vulnerabilities/78321 http://wicket.apache.org/2012/09/06/cve-2012-3373.html http://osvdb.org/85249	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1089`	vulnerable	2026-06-08 05:00:47.389662	Details available Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package. Published: 2012-03-23T18:00:00.000Z Updated: 2024-08-06T18:45:27.315Z Open on db.gcve.eu Reference links http://osvdb.org/80301 http://www.securityfocus.com/bid/52679 http://wicket.apache.org/2012/03/22/wicket-cve-2012-1089.html https://exchange.xforce.ibmcloud.com/vulnerabilities/74276	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.