Apache Sling XSS vulnerabilities

Latest Apache Sling XSS CVEs

Newest publication first

1. CVE-2026-91928 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

   Published 2026-09-23

   Medium·CVSS 6.1 EPSS 0.57%

   Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

2. CVE-2026-91852 Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl

   Published 2026-09-23

   Medium·CVSS 6.1 EPSS 0.79%

   Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

3. CVE-2026-91999 Apache Sling XSS: Improper escaping in the XSS Webconsole plugin

   Published 2026-09-23

   Medium·CVSS 6.1 EPSS 0.57%

   Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

4. CVE-2026-92001 Apache Sling XSS: Missing parser resource limits

   Published 2026-09-23

   Medium·CVSS 6.1 EPSS 0.57%

   Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

5. CVE-2026-73192 Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

   Published 2026-09-23

   Medium·CVSS 6.1 EPSS 0.57%

   An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.