Description
Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow remote attackers to inject arbitrary web script or HTML via a crafted "value" attribute in a element.
Remediation
References
http://wicket.apache.org/news/2016/03/02/cve-2015-7520.html
http://www.securitytracker.com/id/1035166
Related Vulnerabilities
CVE-2019-10287 Vulnerability in maven package org.jenkins-ci.plugins:youtrack-plugin
CVE-2014-3600 Vulnerability in maven package org.apache.activemq:activemq-broker
CVE-2022-29172 Vulnerability in maven package org.webjars.npm:auth0-lock
CVE-2021-28657 Vulnerability in maven package org.apache.tika:tika-parsers
CVE-2023-40176 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates