WSO2 WSO2 Enterprise Integrator

• CVE-2024-2372 Medium 5.4 Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks 0.2%
• CVE-2024-7075 Medium 4.6 Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products 0.2%
• CVE-2024-5139 Medium 6.1 Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection 0.2%
• CVE-2024-2323 Medium 4.8 Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery 0.2%
• CVE-2024-4412 Low 2.7 Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations 0.4%
• CVE-2024-4457 Critical 9.1 Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution 0.4%
• CVE-2025-12317 Medium 5.0 Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges 0.3%
• CVE-2024-6541 Medium 6.8 Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products 0.3%
• CVE-2025-13394 Medium 5.4 Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions 0.1%
• CVE-2024-6832 Medium 5.9 Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks 0.4%
• CVE-2025-6670 High 8.8 Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services 0.2%
• CVE-2025-10853 Medium 5.2 Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding 0.2%
• CVE-2025-11093 High 8.4 Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) 0.5%
• CVE-2025-10907 High 8.4 Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution 0.6%
• CVE-2025-10713 Medium 6.5 XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration 0.5%
• CVE-2025-3125 Medium 6.7 Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution 0.9%
• CVE-2025-5605 Medium 4.3 Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure 0.9%
• CVE-2025-5350 Medium 5.9 SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products 0.6%
• CVE-2025-9804 Critical 9.6 Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs 0.6%
• CVE-2025-9955 Medium 5.7 Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration 0.2%
• CVE-2025-1862 Medium 6.7 Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution 0.5%
• CVE-2024-3511 Medium 4.3 Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files 0.2%
• CVE-2024-8008 Medium 5.2 Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation 0.6%
• CVE-2024-3509 Medium 4.3 Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor 0.2%
• CVE-2024-7074 Medium 6.8 Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution 17.7%
• CVE-2025-2905 Critical 9.1 An XML External Entity (XXE) vulnerability in Multiple WSO2 Products 1.3%
• CVE-2024-0392 Medium 5.4 Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation 0.1%
• CVE-2023-6911 Medium 4.8 Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload in 0.4%
• CVE-2023-6836 Medium 4.6 Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information. 0.5%