{"id":"CVE-2012-5636","aliases":["EUVD-2012-5520","GHSA-fw6r-27g5-6pjj"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5...","description":"Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to \u003cscript\u003e tags in a rendered response.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03504,"percentile":0.89259,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2017-10-30T19:00:00Z","modified":"2026-06-16T23:47:07Z","products":[{"vendor":"apache","product":"wicket"}],"references":[{"url":"https://wicket.apache.org/news/2013/03/03/cve-2012-5636.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/101644","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5636"},{"url":"https://github.com/advisories/GHSA-fw6r-27g5-6pjj"}],"sources":{"cve":[{"id":"CVE-2012-5636","description":"Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to \u003cscript\u003e tags in a rendered response.","status":"published","published":"2017-10-30T19:00:00Z","modified":"2024-08-06T21:14:16.232Z","updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2012-5520","description":"Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to \u003cscript\u003e tags in a rendered response.","status":"published","published":"2017-10-30T19:00:00Z","modified":"2024-08-06T21:14:16Z","updated_at":"2026-11-03T01:56:04.46975Z"}],"ghsa":[{"id":"GHSA-fw6r-27g5-6pjj","title":"Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5...","description":"Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to \u003cscript\u003e tags in a rendered response.","status":"published","published":"2022-05-17T00:22:56Z","modified":"2023-02-03T05:01:36Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:53:00.497966Z"}],"nvd":[{"id":"CVE-2012-5636","description":"Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to \u003cscript\u003e tags in a rendered response.","status":"published","published":"2017-10-30T19:29:00.247Z","modified":"2026-06-16T23:47:07.927Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:18.043773Z"}]}}