anonhaven

CVE-2026-91999

NONE
Updated Sep 23, 2026
Apache Software Foundation
Parameter Value
Affected Versions before 2.4.12.
Fixed In 2.4.12
Type CWE-79 (Cross-Site Scripting (XSS))
Vendor Apache Software Foundation
Public PoC No

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Weakness Type (CWE)

CWE-79 Cross-Site Scripting (XSS)

Vulnerable Products

apache software foundation:apache sling xss

References 1

https://lists.apache.org/thread/xpcsdkr80ow9p13f7hp3ykrhzky9d4t4
security@apache.org
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-96443

Apache Software Foundation

None

CVE-2026-94251

Apache Software Foundation

None

CVE-2026-94243

Apache Software Foundation

None

CVE-2026-92001

Apache Software Foundation

None

CVE-2026-91928

Apache Software Foundation

None