{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-31T12:16:44.311Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/31/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:18:56.360475Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T14:19:06.921Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.wicket:wicket-core",
          "product": "Apache Wicket",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "8.18.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.23.0",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.10.0",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Emond Papegaaij"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of input during web page generation in Apache Wicket.\u003cbr\u003e\u003cbr\u003eorg.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice \u2014 ComponentTag already encodes attribute values when it writes the tag. That reasoning holds only for the attribute. When the component is attached to a \u0026lt;button\u0026gt; element rather than an \u0026lt;input\u0026gt;, it writes its model object into the element body instead, and nothing encodes an element body, so markup in the model is rendered as markup.\u003cbr\u003e\u003cbr\u003eAn application is affected where it renders a Button on a \u0026lt;button\u0026gt; element and that button\u0027s model holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. The subclasses that inherit this constructor \u2014 AjaxButton, AjaxFallbackButton and WizardButton \u2014 are affected on the same terms.\u003cbr\u003e\u003cbr\u003eAs a workaround, calling setEscapeModelStrings(true) on a button that renders as a \u0026lt;button\u0026gt; element escapes the body correctly, and does not cause double encoding, because the value attribute is written only for \u0026lt;input\u0026gt; elements.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.25.0 and 7.5.0 onwards are also affected.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.\u003cbr\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation in Apache Wicket.\n\norg.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice \u2014 ComponentTag already encodes attribute values when it writes the tag. That reasoning holds only for the attribute. When the component is attached to a \u003cbutton\u003e element rather than an \u003cinput\u003e, it writes its model object into the element body instead, and nothing encodes an element body, so markup in the model is rendered as markup.\n\nAn application is affected where it renders a Button on a \u003cbutton\u003e element and that button\u0027s model holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. The subclasses that inherit this constructor \u2014 AjaxButton, AjaxFallbackButton and WizardButton \u2014 are affected on the same terms.\n\nAs a workaround, calling setEscapeModelStrings(true) on a button that renders as a \u003cbutton\u003e element escapes the body correctly, and does not cause double encoding, because the value attribute is written only for \u003cinput\u003e elements.\n\nThis issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.25.0 and 7.5.0 onwards are also affected.\n\nUsers are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T11:52:26.161Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/bhcfrz61o4bv0olktybvgqft8km9wfrd"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Wicket: XSS in Button via its model object",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-76982",
    "datePublished": "2026-08-31T11:52:26.161Z",
    "dateReserved": "2026-08-20T06:50:15.755Z",
    "dateUpdated": "2026-08-31T14:19:06.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/08/31/2\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-08-31T12:16:44.311Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-76982\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-31T14:18:56.360475Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-31T14:19:01.672Z\"}}], \"cna\": {\"title\": \"Apache Wicket: XSS in Button via its model object\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Emond Papegaaij\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/U:Amber\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"AMBER\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Wicket\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.18.0\"}, {\"status\": \"affected\", \"version\": \"9.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"9.23.0\"}, {\"status\": \"affected\", \"version\": \"10.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"10.10.0\"}], \"packageName\": \"org.apache.wicket:wicket-core\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/bhcfrz61o4bv0olktybvgqft8km9wfrd\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper neutralization of input during web page generation in Apache Wicket.\\n\\norg.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice \\u2014 ComponentTag already encodes attribute values when it writes the tag. That reasoning holds only for the attribute. When the component is attached to a \u003cbutton\u003e element rather than an \u003cinput\u003e, it writes its model object into the element body instead, and nothing encodes an element body, so markup in the model is rendered as markup.\\n\\nAn application is affected where it renders a Button on a \u003cbutton\u003e element and that button\u0027s model holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. The subclasses that inherit this constructor \\u2014 AjaxButton, AjaxFallbackButton and WizardButton \\u2014 are affected on the same terms.\\n\\nAs a workaround, calling setEscapeModelStrings(true) on a button that renders as a \u003cbutton\u003e element escapes the body correctly, and does not cause double encoding, because the value attribute is written only for \u003cinput\u003e elements.\\n\\nThis issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.25.0 and 7.5.0 onwards are also affected.\\n\\nUsers are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper neutralization of input during web page generation in Apache Wicket.\u003cbr\u003e\u003cbr\u003eorg.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice \\u2014 ComponentTag already encodes attribute values when it writes the tag. That reasoning holds only for the attribute. When the component is attached to a \u0026lt;button\u0026gt; element rather than an \u0026lt;input\u0026gt;, it writes its model object into the element body instead, and nothing encodes an element body, so markup in the model is rendered as markup.\u003cbr\u003e\u003cbr\u003eAn application is affected where it renders a Button on a \u0026lt;button\u0026gt; element and that button\u0027s model holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. The subclasses that inherit this constructor \\u2014 AjaxButton, AjaxFallbackButton and WizardButton \\u2014 are affected on the same terms.\u003cbr\u003e\u003cbr\u003eAs a workaround, calling setEscapeModelStrings(true) on a button that renders as a \u0026lt;button\u0026gt; element escapes the body correctly, and does not cause double encoding, because the value attribute is written only for \u0026lt;input\u0026gt; elements.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 6.25.0 and 7.5.0 onwards are also affected.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-08-31T11:52:26.161Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-76982\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-31T14:19:06.921Z\", \"dateReserved\": \"2026-08-20T06:50:15.755Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-08-31T11:52:26.161Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}