Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java 2.0.1 before 2.0.2 Description: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue...
CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/558
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 - Apache Axis2/Java before 2.0.2 Description: Direct Request…
CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution
Posted by Robert Lazarski on Nov 06 Severity: moderate Affected versions: - Apache Axis2/Java before 2.0.2 Description: Server-Side Request Forgery (SSRF) vulnerability…
CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 Description: Allocation of Resources Without Limits or Throttling…
CVE-2026-123770: Apache Axis2/Java: Unbounded multipart and form-encoded request bodies
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 Description: Allocation of Resources Without Limits or Throttling…
CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2.0.2 Description: Server-Side Request Forgery (SSRF) vulnerability…
CVE-2026-120761: Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents
Posted by Robert Lazarski on Nov 06 Severity: important Affected versions: - Apache Axis2/Java before 2.0.2 Description: Improper Restriction of XML External Entity…