Skip to content
Wso2 Api Manager vulnerabilities
-
wso2 api control plane, api manager, identity server +5 more +7 more
Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
CVE-2025-12737
8.4 High
-
wso2 api control plane, api manager +1 more
Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads
CVE-2026-3416
5.9 Medium
-
wso2 api control plane, api manager, multiple products +3 more +5 more
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
CVE-2026-5430
In KEVPublic exploit
EPSS 22.4%
10.0 Critical
-
wso2 api control plane, api manager, traffic manager +3 more +5 more
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
CVE-2026-1728
9.8 Critical
-
wso2 api control plane, api manager, identity server +7 more +9 more
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
CVE-2025-15039
9.4 Critical
-
wso2 api control plane, api manager, identity server +5 more +7 more
Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
CVE-2026-0637
5.4 Medium
-
wso2 api control plane, api manager, enterprise integrator +44 more +46 more
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
CVE-2025-13394
5.4 Medium
-
wso2 api manager, identity server, identity server as key manager +2 more +4 more
Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery
CVE-2025-13736
3.7 Low
-
wso2 api control plane, api manager, identity server +5 more +7 more
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
CVE-2024-10302
4.0 Medium
-
wso2 api control plane, api manager, identity server +7 more +9 more
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
CVE-2024-6832
5.9 Medium
-
wso2 api control plane, api manager, identity server +6 more +8 more
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
CVE-2024-8995
4.9 Medium
-
wso2 api control plane, api manager, identity server +2 more
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
CVE-2026-2445
6.1 Medium
-
wso2 api control plane, api manager, traffic manager +1 more +3 more
Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
CVE-2026-4249
8.6 High
-
wso2 api control plane, api manager, identity server +5 more +7 more
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
CVE-2025-8591
6.1 Medium
-
wso2 api manager, identity server, identity server as key manager +2 more +4 more
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
CVE-2024-1248
4.8 Medium
-
wso2 api manager, identity server +1 more
Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure
CVE-2025-13475
3.5 Low
-
wso2 api manager
Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
CVE-2026-2053
8.3 High
-
wso2 api control plane, api manager, traffic manager +3 more +5 more
Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
CVE-2025-8325
6.3 Medium
-
wso2 api control plane, api manager, traffic manager +3 more +5 more
HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
CVE-2025-8154
5.3 Medium
-
wso2 api manager, identity server +1 more
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites
CVE-2025-6024
6.1 Medium
-
wso2 api manager
Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection
CVE-2024-10242
6.1 Medium
-
wso2 api manager
XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files
CVE-2024-8010
3.5 Low
-
wso2 api manager
Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval
CVE-2024-4867
5.4 Medium
-
wso2 api manager, identity server, identity server as key manager +2 more +4 more
XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
CVE-2024-2374
7.5 High
-
wso2 api manager, identity server +1 more
A local user can be impersonated when using federated authentication with Silent JIT Provisioning.
CVE-2024-1524
7.7 High
-
wso2 api control plane, api manager, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl +2 more +4 more
Authenticated arbitrary file upload via a System REST API requiring administrator permission.
CVE-2025-13590
Fix available
9.1 Critical
-
wso2 api manager, api control plane, identity server +7 more +9 more
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
CVE-2025-9312
9.8 Critical
-
wso2 api control plane, api manager, enterprise integrator +7 more +9 more
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
CVE-2025-6670
8.8 High
-
wso2 api control plane, api manager, enterprise integrator +10 more +12 more
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
CVE-2025-10853
5.2 Medium
-
wso2 api control plane, api manager, identity server +2 more
Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
CVE-2025-5770
6.1 Medium
-
wso2 api manager, enterprise integrator, micro integrator +8 more +10 more
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
CVE-2025-11093
8.4 High
-
wso2 api control plane, api manager, enterprise integrator +15 more +17 more
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
CVE-2025-10907
8.4 High
-
wso2 api control plane, api manager, enterprise integrator +7 more +9 more
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
CVE-2025-10713
Fix available
6.5 Medium
-
wso2 api control plane, api manager, enterprise integrator +6 more +8 more
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
CVE-2025-3125
6.7 Medium
-
wso2 api control plane, api manager, enterprise integrator +7 more +9 more
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
CVE-2025-5605
4.3 Medium
-
wso2 api control plane, api manager, enterprise integrator +7 more +9 more
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
CVE-2025-5350
5.9 Medium
-
wso2 api manager, api control plane +1 more
Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
CVE-2025-9152
9.8 Critical
-
wso2 api manager, api manager analytics, api control plane +19 more +21 more
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
CVE-2025-9804
9.6 Critical
-
wso2 api control plane, api manager, identity server +8 more +10 more
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
CVE-2025-10611
9.8 Critical
-
wso2 api manager, identity server, identity server as key manager +2 more
Content Spoofing in Multiple WSO2 Products via Error Message Injection
CVE-2024-6429
Fix available
4.3 Medium
-
wso2 api control plane, api manager, open banking am +2 more +4 more
Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
CVE-2025-5717
6.8 Medium
-
wso2 api control plane, api manager, traffic manager +2 more +4 more
Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher
CVE-2025-4760
Fix available
4.8 Medium
-
wso2 api manager, micro integrator +1 more
Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator
CVE-2024-4598
6.5 Medium
-
wso2 api manager, enterprise integrator, identity server +4 more +6 more
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
CVE-2024-3511
4.3 Medium
-
wso2 api manager, identity server, identity server as key manager +3 more +5 more
Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint
CVE-2024-1440
Fix available
5.4 Medium
-
wso2 api manager, enterprise integrator, identity server +7 more +9 more
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
CVE-2024-8008
Fix available
5.2 Medium
-
wso2 api manager, enterprise integrator, identity server +4 more +6 more
Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
CVE-2024-3509
4.3 Medium
-
wso2 api manager, identity server, identity server as key manager +4 more +6 more
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
CVE-2024-7097
4.3 Medium
-
wso2 api manager, identity server, identity server as key manager +4 more +6 more
Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
CVE-2024-7096
Fix available
4.2 Medium
-
wso2 api manager, identity server +1 more
Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding
CVE-2024-5962
6.1 Medium
- Show olderLoading…