CVE-2026-28813: Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.
Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-28813
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-288130.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-28813 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Apache JSPWiki
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-48910: A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when …nvd · 2026-07-30
- highCVE-2026-28814: Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 a…nvd · 2026-07-30
- criticalCVE-2026-28812: UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow…nvd · 2026-07-30
- highCVE-2026-28811: Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are rec…nvd · 2026-07-30
More from NVD Recent CVEs
- criticalCVE-2026-8457: The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in a…2026-08-02
- highCVE-2026-18352: The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versi…2026-08-02
- highCVE-2026-13339: The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions…2026-08-02
- unknownCVE-2026-17002: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.2026-08-01
- unknownCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…2026-08-01