CVE-2026-28813

CVE-2026-28813: Apache JSPWiki: JSPWiki vulnerable to JSON hijacking

Vendor Apache Software Foundation

Product Apache JSPWiki

Weakness CWE-352 · CSRF

Published July 30, 2026

Last update July 31, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.

Key dates

02Disclosure timeline

July 30, 2026 CVE published

July 31, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-28813 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities

04Related CVE

CVE-2026-60025 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 CVE-2026-57759 WordPress ProfileGrid plugin <= 5.9.9.7 - CSRF to Account Takeover vulnerability CVE-2026-17608 WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion CVE-2026-65460 WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-9731 Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update