Skip to contentWso2 Enterprise Integrator vulnerabilities
- wso2 api control plane, api manager, enterprise integrator +44 more +46 moreCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsCVE-2025-133945.4 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreCross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin ServicesCVE-2025-66708.8 High
- wso2 api control plane, api manager, enterprise integrator +10 more +12 moreReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingCVE-2025-108535.2 Medium
- wso2 api manager, enterprise integrator, micro integrator +8 more +10 moreArbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)CVE-2025-110938.4 High
- wso2 api control plane, api manager, enterprise integrator +15 more +17 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionCVE-2025-109078.4 High
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreXML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationCVE-2025-10713Fix available6.5 Medium
- wso2 api control plane, api manager, enterprise integrator +6 more +8 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionCVE-2025-31256.7 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureCVE-2025-56054.3 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreSSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 ProductsCVE-2025-53505.9 Medium
- wso2 api manager, api manager analytics, api control plane +19 more +21 moreImproper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIsCVE-2025-98049.6 Critical
- wso2 enterprise integrator, enterprise service bus, org.wso2.carbon:org.wso2.carbon.base +1 more +3 moreImproper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store ConfigurationCVE-2025-99555.7 Medium
- wso2 enterprise integrator, identity server, identity server as key manager +1 more +3 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code ExecutionCVE-2025-18626.7 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned FilesCVE-2024-35114.3 Medium
- wso2 api manager, enterprise integrator, identity server +7 more +9 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection ValidationCVE-2024-8008Fix available5.2 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreStored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text EditorCVE-2024-35094.3 Medium
- wso2 enterprise integratorCross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token ValidationCVE-2024-03925.4 Medium
- wso2 api manager, api manager analytics, api microgateway +7 more +9 moreWSO2 Registry Stored Cross Site Scripting (XSS) vulnerabilityCVE-2023-6911Fix available4.8 Medium
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 products vulnerable to XML External Entity attackCVE-2023-6836Fix available4.6 Medium
- wso2 enterprise integratorAn issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting ...CVE-2022-39810EPSS 58.3%6.1 Medium
- wso2 enterprise integratorAn issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting ...CVE-2022-398096.1 Medium
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreA reflected XSS issue exists in the Management Console of several WSO2 products. This affects API...CVE-2022-29548Public exploitEPSS 41.1%4.6 Medium
- wso2 api manager, enterprise integrator, identity server +6 more +8 moreCertain WSO2 products allow unrestricted file upload with resultant remote code execution. This...CVE-2022-29464In KEVPublic exploitEPSS 100.0%9.8 Critical
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.CVE-2020-17453Public exploitEPSS 26.2%6.1 Medium
- wso2 enterprise integratorWSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS)...CVE-2020-255165.4 Medium
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreAn issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This...CVE-2020-247046.1 Medium
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreAn issue was discovered in certain WSO2 products. A valid Carbon Management Console session...CVE-2020-247038.8 High
- wso2 api manager, api manager analytics, api microgateway +2 more +4 moreThe Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates....CVE-2020-245916.5 Medium
- wso2 api manager, api manager analytics, api microgateway +4 more +6 moreXXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and...CVE-2020-127198.7 High
- wso2 enterprise integratorWSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin...CVE-2020-118854.0 Medium
- wso2 api manager, enterprise integrator, identity server +2 moreAn issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as...CVE-2019-204423.5 Low
- wso2 api manager, enterprise integrator, identity server +2 moreAn issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as...CVE-2019-204433.5 Low
- wso2 enterprise integratorIn WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor...CVE-2019-195876.1 Medium
- wso2 data analytics server, api manager, app manager +14 more +16 moreWSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via...CVE-2017-146514.8 Medium