VendorsApachesling_xss_protection_apiall versions
Vulnerabilities

Apache Sling XSS Protection API

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

6CVEs
CVE-2017-15717
A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.
Published 2018-01-10 · Modified
6.1EPSS 0.029
CVE-2026-91852
Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
Published 2026-09-23 · Analyzed
6.1EPSS 0.008
CVE-2026-73192
Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
Published 2026-09-23 · Analyzed
6.1EPSS 0.006
CVE-2026-91928
Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
Published 2026-09-23 · Analyzed
6.1EPSS 0.006
CVE-2026-91999
Apache Sling XSS: Improper escaping in the XSS Webconsole plugin
Published 2026-09-23 · Analyzed
6.1EPSS 0.006
CVE-2026-92001
Apache Sling XSS: Missing parser resource limits
Published 2026-09-23 · Analyzed
6.1EPSS 0.006