Skip to contentWso2 Carbon vulnerabilities
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreSSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 ProductsCVE-2025-53505.9 Medium
- wso2 api manager, api manager analytics, api control plane +19 more +21 moreImproper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIsCVE-2025-98049.6 Critical
- wso2 enterprise integrator, enterprise service bus, org.wso2.carbon:org.wso2.carbon.base +1 more +3 moreImproper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store ConfigurationCVE-2025-99555.7 Medium
- wso2 api control plane, api manager, identity server +8 more +10 morePotential Broken Access Control in Multiple WSO2 Products via System REST APIsCVE-2025-106119.8 Critical
- wso2 api control plane, api manager, traffic manager +2 more +4 moreAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherCVE-2025-4760Fix available4.8 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned FilesCVE-2024-35114.3 Medium
- wso2 api manager, identity server, identity server as key manager +3 more +5 moreOpen Redirection in Multiple WSO2 Products via Multi-Option Authentication EndpointCVE-2024-1440Fix available5.4 Medium
- wso2 api manager, enterprise integrator, identity server +7 more +9 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection ValidationCVE-2024-8008Fix available5.2 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreStored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text EditorCVE-2024-35094.3 Medium
- wso2 api manager, carbon synapse artifact uploader be, enterprise integrator +4 more +6 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code ExecutionCVE-2024-7074EPSS 17.7%6.8 Medium
- wso2 identity server, identity server as key manager, open banking iam +2 more +4 moreUnauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin ServicesCVE-2024-70736.5 Medium
- wso2 identity server, client attestation filter, carbon identity client attestation met data mgt be +2 moreImproper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native AuthenticationCVE-2024-74875.8 Medium
- wso2 api manager, identity server, identity server as key manager +6 more +8 moreIncorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverCVE-2024-69149.8 Critical
- wso2 api manager, carbon identity application authentication endpoint, carbon identity application authentication framework +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationCVE-2023-6837Fix available8.5 High
- wso2 carbon-registryWSO2 carbon-registry Request Parameter cross site scriptingCVE-2022-4521Fix available3.5 Low
- wso2 carbon-registryWSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scriptingCVE-2022-4520Fix available3.5 Low
- wso2 carbonWSO2 Carbon vulnerable to Cross-site ScriptingCVE-2016-4316Public exploit6.1 Medium
- wso2 carbonCross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to...CVE-2016-4315Public exploit5.7 Medium
- wso2 carbonWSO2 Carbon directory traversal vulnerabilityCVE-2016-4314Public exploitEPSS 12.4%4.9 Medium