Sling Cms

sling_cms

Vendor: Apache • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-22849 1Apache 1Sling Cms Jun 17, 2026 Feb 4, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cr...Show more An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling App CMS >= 1.1.6 Show less
CVE-2022-46769 1Apache 1Sling Cms Jun 17, 2026 Jan 9, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cr...Show more An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature. Upgrade to Apache Sling App CMS >= 1.1.4 Show less
CVE-2022-43670 1Apache 1Sling Cms Jun 17, 2026 Nov 2, 2022 N/A· v4 5.4 MEDIUM· v3 N/A· v2 An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cr...Show more An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.Show less
CVE-2020-1949 1Apache 1Sling Cms Jun 17, 2026 Apr 1, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks.