Advisory Weakness Curation

Cross site scripting in Apache Sling In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

Cross-site Scripting In the XSS Protection API module in Apache Sling, the encoding done by the `XSSAPI.encodeForJSString()` method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.