CVE-2026-2053High 8.3Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager0.4%
CVE-2025-8325Medium 6.3Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations0.2%
CVE-2025-8154Medium 5.3HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation0.2%
CVE-2025-6024Medium 6.1Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites0.2%
CVE-2024-10242Medium 6.1Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection0.2%
CVE-2024-8010Low 3.5XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files0.3%
CVE-2024-4867Medium 5.4Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval0.2%
CVE-2024-2374High 7.5XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service0.4%
CVE-2024-1524High 7.7A local user can be impersonated when using federated authentication with Silent JIT Provisioning.0.3%
CVE-2025-13590Critical 9.1Authenticated arbitrary file upload via a System REST API requiring administrator permission.0.8%
CVE-2025-9312Critical 9.8Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products0.2%
CVE-2025-6670High 8.8Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services0.2%
CVE-2025-10853Medium 5.2Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding0.2%
CVE-2025-5770Medium 6.1Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products0.2%
CVE-2025-11093High 8.4Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)0.5%
CVE-2025-10907High 8.4Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution0.6%
CVE-2025-10713Medium 6.5XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration0.5%
CVE-2025-3125Medium 6.7Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution0.9%
CVE-2025-5605Medium 4.3Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure0.9%
CVE-2025-5350Medium 5.9SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products0.6%
CVE-2025-9152Critical 9.8Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint0.7%
CVE-2025-9804Critical 9.6Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs0.6%
CVE-2025-10611Critical 9.8Potential Broken Access Control in Multiple WSO2 Products via System REST APIs0.8%
CVE-2024-6429Medium 4.3Content Spoofing in Multiple WSO2 Products via Error Message Injection0.2%
CVE-2025-5717Medium 6.8Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service0.7%
CVE-2025-4760Medium 4.8Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher0.2%
CVE-2024-4598Medium 6.5Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator0.3%
CVE-2024-3511Medium 4.3Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files0.2%
CVE-2024-1440Medium 5.4Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint0.2%
CVE-2024-8008Medium 5.2Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation0.6%
CVE-2024-3509Medium 4.3Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor0.2%
CVE-2024-7074Medium 6.8Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution17.7%
CVE-2024-7097Medium 4.3Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup0.7%
CVE-2024-7096Medium 4.2Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw0.7%
CVE-2024-5962Medium 6.1Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding0.3%
CVE-2024-6914Critical 9.8Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover0.8%
CVE-2025-2905Critical 9.1An XML External Entity (XXE) vulnerability in Multiple WSO2 Products1.3%
CVE-2024-5848Medium 6.1Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation0.2%
CVE-2024-2321Medium 5.6Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token0.2%
CVE-2023-6911Medium 4.8Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload in0.4%
CVE-2023-6839Medium 5.3Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response.
0.5%
CVE-2023-6838Medium 6.1Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.
0.4%
CVE-2023-6837High 8.5Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation0.5%
CVE-2023-6836Medium 4.6Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.0.5%
CVE-2023-6835Medium 4.3Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.0.5%