anonhaven

CVE-2026-91928

NONE
Updated Sep 23, 2026
Apache
Parameter Value
Affected Versions before 2.4.12.
Fixed In 2.4.12
Type CWE-79 (Cross-Site Scripting (XSS))
Vendor Apache
Public PoC No

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Weakness Type (CWE)

CWE-79 Cross-Site Scripting (XSS)

Vulnerable Products

apache software foundation:apache sling xss

References 1

https://lists.apache.org/thread/yfb1q6zob8mth5lr4jnsy3lhx9rfwb02
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-87022

Apache

None

CVE-2026-86350

Apache

None

CVE-2026-86248

Apache

None

CVE-2026-79677

Apache

None

CVE-2026-78437

Apache

None