Apache Sling XSS before 2.4.14 allows XSS via getStyleToken (CVE-2026-123765)
xssAPI.getStyleToken() accepts markup in unquoted URLs; Apache rates it low and fixes it in 2.4.14.
Stories per day · 30 days
2 RSS
2 stories, newest first · one card per story
Stories tagged #apache-sling
CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
Low-severity reflected XSS vulnerability disclosed in Apache Sling XSS library's getValidHref() method, patched in v2.4.12.