[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftM82_9yZBjwgl-5NoH4ibhUPWUBiD3ERci05BjC5lBc":3,"g5a-ex:apache\u002Fsling@*":104,"g5a-family:apache\u002Fsling":106},{"success":4,"data":5},true,{"product":6,"versions":32,"topVulnerabilitiesByEpss":41,"kevVulnerabilities":81,"seoMetadata":82,"meta":101},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":31},"apache","sling",8,6,0,"2017-07-19",[14,17,19,21,23,25,27,29],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},"1.0.0",false,{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},"1.0.10",{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},"1.0.12",{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},"1.0.2",{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},"1.0.4",{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},"1.0.6",{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},"1.0.8",{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},"1.1.6","Sling by Apache is a technology product with 8 tracked versions and 6 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[33,34,35,36,37,38,39,40],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},{"version":26,"cve_count":11,"kev_count":11,"has_kev":16},{"version":28,"cve_count":11,"kev_count":11,"has_kev":16},{"version":30,"cve_count":11,"kev_count":11,"has_kev":16},[42,50,58,63,69,75],{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"cvssVersion":47,"severity":48,"isKev":16,"epssScore":49},"CVE-2016-0956","The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.","2016-02-10",7.5,"v3.0","High",0.51151,{"cveId":51,"description":52,"publishedDate":53,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":16,"epssScore":57},"CVE-2012-2138","The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.","2012-07-09",5,"v2","Medium",0.14122,{"cveId":59,"description":60,"publishedDate":61,"cvssScore":54,"cvssVersion":55,"severity":56,"isKev":16,"epssScore":62},"CVE-2013-2254","The deepGetOrCreateNode function in impl\u002Foperations\u002FAbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.","2013-10-17",0.04093,{"cveId":64,"description":65,"publishedDate":12,"cvssScore":66,"cvssVersion":47,"severity":67,"isKev":16,"epssScore":68},"CVE-2016-6798","In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.",9.8,"Critical",0.03669,{"cveId":70,"description":71,"publishedDate":72,"cvssScore":73,"cvssVersion":55,"severity":56,"isKev":16,"epssScore":74},"CVE-2013-4390","Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to \"a custom login form and XSS.\"","2013-10-24",5.8,0.03056,{"cveId":76,"description":77,"publishedDate":12,"cvssScore":78,"cvssVersion":79,"severity":56,"isKev":16,"epssScore":80},"CVE-2016-5394","In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.",6.1,"v3.1",0.02604,[],{"title":83,"metaDescription":84,"keywords":85,"structuredData":86},"Sling by Apache - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Sling by Apache covering 8 versions with 6 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Sling vulnerabilities, Sling security, Sling CVE, Apache Sling, Sling threat intelligence, Apache security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":87,"@type":88,"name":89,"description":84,"url":90,"manufacturer":91,"applicationCategory":95,"softwareVersion":96,"mainEntity":97},"https:\u002F\u002Fschema.org","SoftwareApplication","Sling","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fapache\u002Fsling",{"@type":92,"name":93,"url":94},"Organization","Apache","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fapache","Security Software","8 versions tracked",{"@type":98,"name":99,"description":100,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Sling Security Vulnerabilities","Security vulnerabilities affecting Sling by Apache",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":102,"apiVersion":103},"2026-10-18T19:50:14.368Z","3.0",{"rows":105,"total":11,"capped":16,"failed":11},[],[107,110,113,115,118,120,122,124,126,128,130,132],{"product":108,"cves":109},"sling_cms",4,{"product":111,"cves":112},"sling_servlets_post",2,{"product":114,"cves":112},"sling_api",{"product":116,"cves":117},"sling_commons_json",1,{"product":119,"cves":117},"sling_commons_log",{"product":121,"cves":117},"sling_commons_messaging_mail",{"product":123,"cves":117},"sling_i18n",{"product":125,"cves":117},"sling_jcr_base",{"product":127,"cves":117},"sling_jcr_contentloader",{"product":129,"cves":117},"sling_resource_merger",{"product":131,"cves":117},"sling_servlets_resolver",{"product":133,"cves":117},"sling_xss_protection_api"]