Apache: >> Jspwiki >> 2.12.2 Security Vulnerabilities
A carefully crafted editing request could trigger an XSS vulnerability
on Apache JSPWiki when parsing errors on the markdown renderer, which
could allow the attacker to execute javascript in the victim's browser
and get some sensitive information about the victim.
This issue affects Apache JSPWiki: through 2.12.3.
Users are recommended to upgrade to version 2.12.4, which fixes the issue.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-07-30
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.
Users are recommended to upgrade to version 2.12.4, which fixes this issue.
CVSS Score
8.8
EPSS Score
0.001
Published
2026-07-30
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.
Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-07-30
Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.
Users are recommended to upgrade to version 2.12.4, which fixes this issue.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-07-30
UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.
Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.
CVSS Score
9.8
EPSS Score
0.003
Published
2026-07-30
A carefully crafted request using the Image plugin could trigger an XSS
vulnerability on Apache JSPWiki, which could allow the attacker to
execute javascript in the victim's browser and get some sensitive
information about the victim.
Apache JSPWiki users should upgrade to 2.12.3 or later.
CVSS Score
6.1
EPSS Score
0.004
Published
2025-07-31
A carefully crafted request when creating a header link using the
wiki markup syntax, which could allow the attacker to execute javascript
in the victim's browser and get some sensitive information about the
victim.
Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.
Apache JSPWiki users should upgrade to 2.12.3 or later.
CVSS Score
7.5
EPSS Score
0.005
Published
2025-07-31