Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Apache Software Foundation
- Product
- Apache Sling Engine
- Fix
- available
- Weakness
- CWE-79, CWE-693
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 25 (Notable)
- Product class: web platform
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-103863 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.