params: Remove/unlink params content (being moved to add-on)

[kingthorin]

Part of: zaproxy/zaproxy#9210 related to: zaproxy/zap-extensions#6933

[psiinon]

Checkmarx One – Scan Summary & Details – c08d8785-f95d-4d6e-ada6-d2971892b9dd

---

New Issues (13)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2025-48734	Maven-commons-beanutils:commons-beanutils-1.9.4	details Recommended version: 1.11.0 Description: An Improper Access Control vulnerability exists in Apache Commons. A special "BeanIntrospector" class was added in version 1.9.2. This can be used ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2		Cx78f40514-81ff	Maven-commons-collections:commons-collections-3.2.2	details Description: The framework Apache Commons Collections before 4.3 is vulnerable to Stack Overflow. The function `add()` in the file `SetUniqueList.java` throws a... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
3		CVE-2012-5783	Maven-commons-httpclient:commons-httpclient-3.1	details Description: Apache Commons HttpClient prior to 4.0-alpha1, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not ver... Attack Vector: NETWORK Attack Complexity: MEDIUM Vulnerable Package
4		CVE-2012-6153	Maven-commons-httpclient:commons-httpclient-3.1	details Description: http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain na... Attack Vector: NETWORK Attack Complexity: MEDIUM Vulnerable Package
5		CVE-2020-13956	Maven-commons-httpclient:commons-httpclient-3.1	details Description: Apache HttpClient can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong ta... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
6		CVE-2022-27820	Maven-org.zaproxy:zap-2.16.0	details Description: OWASP Zed Attack Proxy (ZAP) does not verify the TLS certificate chain of an HTTPS server. Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
7		CVE-2025-46392	Maven-commons-configuration:commons-configuration-1.10	details Description: Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration versions 1.x. There are a number of issues in Apache Commons Confi... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
8		CVE-2025-48924	Maven-commons-lang:commons-lang-2.6	details Recommended version: 2.7-atlassian-1 Description: Uncontrolled Recursion vulnerability in Apache Commons Lang. The methods `ClassUtils.getClass(...)` can `throwStackOverflowError` on very long inpu... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
9		CVE-2025-48924	Maven-org.apache.commons:commons-lang3-3.17.0	details Recommended version: 3.18.0 Description: Uncontrolled Recursion vulnerability in Apache Commons Lang. The methods `ClassUtils.getClass(...)` can `throwStackOverflowError` on very long inpu... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
10		CVE-2025-68161	Maven-org.apache.logging.log4j:log4j-core-2.24.2	details Recommended version: 2.25.4 Description: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
11		CVE-2026-34478	Maven-org.apache.logging.log4j:log4j-core-2.24.2	details Recommended version: 2.25.4 Description: Apache Log4j Core's Rfc5424Layout https://logging\.apache\.org/log4j/2\.x/manual/layouts\.html\#RFC5424Layout , in versions 2.21.0 through 2.25.3, and ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
12		CVE-2026-34479	Maven-org.apache.logging.log4j:log4j-1.2-api-2.24.2	details Recommended version: 2.25.4 Description: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
13		CVE-2026-34480	Maven-org.apache.logging.log4j:log4j-core-2.24.2	details Recommended version: 2.25.4 Description: Apache Log4j Core's XmlLayout https://logging\.apache\.org/log4j/2\.x/manual/layouts\.html\#XmlLayout , versions through 2.25.3, and 3.x through 3.0.0-... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

[thc202]

This can only be merged when the add-on is in actual use/ready.

[kingthorin]

Okay,want me to convert to draft for now?

[thc202]

I'm fine leaving as is, as long as we don't merge it before time.

[kingthorin]

Who knows how long this might sit, we don’t have a release plan yet so just so there’s no mistakes in like two months or something draft will be safer 😉

[thc202]

The target ui.tabs.params needs to be removed from the map file.

[kingthorin]

Done

[thc202]

Thank you!