Apache Sling vulnerabilities

• apache sling security, apache software foundation sling security bundle +1 more Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence CVE-2026-94243 7.3 HighSeptember 23, 2026
• apache sling security, apache software foundation sling security bundle +1 more Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource CVE-2026-94251 6.5 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms CVE-2026-91928 6.1 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl CVE-2026-91852 6.1 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: Improper escaping in the XSS Webconsole plugin CVE-2026-91999 6.1 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: Missing parser resource limits CVE-2026-92001 6.1 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: XSS possible through XSSAPI.getValidHref() CVE-2026-73192 6.1 MediumSeptember 23, 2026
• apache sling servlets resolver Apache Sling Servlets Resolver: Malicious code execution via path traversal CVE-2024-23673 Public exploitFix available 8.5 HighFebruary 6, 2024
• apache sling commons json, apache software foundation org.apache.sling.commons.json +1 more Multiple parsing problems in the Apache Sling Commons JSON module CVE-2022-47937 9.8 CriticalMay 15, 2023
• apache sling engine, sling +1 more Apache Sling Engine: Include-based XSS CVE-2022-45064 Fix available 8.0 HighApril 13, 2023
• apache sling resource merger Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS CVE-2023-26513 Fix available 7.5 HighMarch 20, 2023
• apache software foundation sling, apache sling i18n +1 more Apache Sling does not allow to handle i18n content in a secure way CVE-2023-25621 Fix available 6.5 MediumFebruary 23, 2023
• apache sling jcr base JNDI injection into Apache sling-org-apache-sling-jcr-base CVE-2023-25141 Fix available 7.5 HighFebruary 14, 2023
• apache software foundation sling app cms, apache sling cms +1 more Apache Sling App CMS: XSS in CMS Reference / UI Components CVE-2023-22849 Fix available 6.1 MediumFebruary 4, 2023
• apache software foundation sling app cms, apache sling cms +1 more Apache Sling App CMS: XSS in CMS Site Group Detail CVE-2022-46769 Fix available 5.4 MediumJanuary 9, 2023
• apache sling cms, apache software foundation sling app cms +1 more XSS in Sling CMS Reference App Taxonomy Path CVE-2022-43670 Fix available 5.4 MediumNovember 2, 2022
• apache sling api, sling commons log, apache software foundation sling +2 more log injection in Sling logging CVE-2022-32549 5.3 MediumJune 22, 2022
• apache sling commons messaging mail SMTPS server hostname not checked when making TLS connection to SMTPS server CVE-2021-44549 Fix available 7.4 HighDecember 14, 2021
• apache sling cms, apache software foundation sling +1 more Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when... CVE-2020-1949 6.1 MediumApril 1, 2020
• apache sling xss protection api, sling xss protection api compat, apache software foundation sling +2 more Cross-site Scripting in Apache Sling XSS Protection API CVE-2017-15717 Fix available 6.1 MediumJanuary 10, 2018
• apache sling jcr contentloader, apache software foundation sling +1 more Apache Sling JCR ContentLoader XmlReader Arbitrary File Load CVE-2012-3353 Fix available 7.5 HighJanuary 8, 2018
• apache sling authentication service, apache software foundation sling +1 more Apache Sling Authentication Service vulnerability CVE-2017-15700 Fix available 8.8 HighDecember 18, 2017
• apache sling servlets post Improper Neutralization of Input During Web Page Generation Apache Sling Servlets Post CVE-2017-9802 Fix available 6.1 MediumAugust 14, 2017
• apache sling XML External Entity Reference in Apache Sling CVE-2016-6798 Public exploitFix available 9.8 CriticalJuly 19, 2017
• apache sling Cross site scripting in Apache Sling CVE-2016-5394 Public exploitFix available 6.1 MediumJuly 19, 2017
• adobe experience manager, apache sling +1 more Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post CVE-2016-0956 Public exploitFix available EPSS 51.2% 7.5 HighFebruary 10, 2016
• apache sling api, sling servlets post +1 more Improper Neutralization of Input During Web Page Generation in Apache Sling CVE-2015-2944 Fix available 4.3 MediumJune 2, 2015
• apache sling, sling auth core component +1 more Apache Sling Auth Core bundle vulnerable to Open Redirection CVE-2013-4390 Fix available 5.8 MediumOctober 24, 2013
• apache org.apache.sling.servlets.post Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling CVE-2013-2254 Fix available 5.0 MediumOctober 17, 2013
• apache org.apache.sling.servlets.post Apache Sling POST Servlets Denial of Service Vulnerability CVE-2012-2138 Public exploitFix available EPSS 14.1% 5.0 MediumJuly 9, 2012