Apache Wicket versions 1.4.x and 1.5.x suffer from an issue where it is possible to inject JavaScript statements into an ajax link by adding an encoded null byte to a URL pointing to a Wicket app. This could be done by sending a legitimate user a manipulated URL and tricking the user into clicking on it.
7a7ab76ed2c774089e49a2913b4038177b448d209210e64d3c734465d4cfdab1