Skip to contentWso2 Api Manager vulnerabilities
- wso2 api managerUnauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API ManagerCVE-2026-20538.3 High
- wso2 api control plane, api manager, traffic manager +3 more +5 moreImproper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized OperationsCVE-2025-83256.3 Medium
- wso2 api control plane, api manager, traffic manager +3 more +5 moreHTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header ManipulationCVE-2025-81545.3 Medium
- wso2 api manager, identity server +1 moreCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious WebsitesCVE-2025-60246.1 Medium
- wso2 api managerReflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and RedirectionCVE-2024-102426.1 Medium
- wso2 api managerXML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary FilesCVE-2024-80103.5 Low
- wso2 api managerCross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information RetrievalCVE-2024-48675.4 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreXML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of ServiceCVE-2024-23747.5 High
- wso2 api manager, identity server +1 moreA local user can be impersonated when using federated authentication with Silent JIT Provisioning.CVE-2024-15247.7 High
- wso2 api control plane, api manager, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl +2 more +4 moreAuthenticated arbitrary file upload via a System REST API requiring administrator permission.CVE-2025-13590Fix available9.1 Critical
- wso2 api manager, api control plane, identity server +7 more +9 moreImproper Certificate-Based Authentication Enforcement in Multiple WSO2 ProductsCVE-2025-93129.8 Critical
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreCross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin ServicesCVE-2025-66708.8 High
- wso2 api control plane, api manager, enterprise integrator +10 more +12 moreReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingCVE-2025-108535.2 Medium
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 ProductsCVE-2025-57706.1 Medium
- wso2 api manager, enterprise integrator, micro integrator +8 more +10 moreArbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)CVE-2025-110938.4 High
- wso2 api control plane, api manager, enterprise integrator +15 more +17 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionCVE-2025-109078.4 High
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreXML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationCVE-2025-10713Fix available6.5 Medium
- wso2 api control plane, api manager, enterprise integrator +6 more +8 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionCVE-2025-31256.7 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureCVE-2025-56054.3 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreSSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 ProductsCVE-2025-53505.9 Medium
- wso2 api manager, api control plane +1 moreImproper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR EndpointCVE-2025-91529.8 Critical
- wso2 api manager, api manager analytics, api control plane +19 more +21 moreImproper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIsCVE-2025-98049.6 Critical
- wso2 api control plane, api manager, identity server +8 more +10 morePotential Broken Access Control in Multiple WSO2 Products via System REST APIsCVE-2025-106119.8 Critical
- wso2 api manager, identity server, identity server as key manager +2 moreContent Spoofing in Multiple WSO2 Products via Error Message InjectionCVE-2024-6429Fix available4.3 Medium
- wso2 api control plane, api manager, open banking am +2 more +4 moreAuthenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin ServiceCVE-2025-57176.8 Medium
- wso2 api control plane, api manager, traffic manager +2 more +4 moreAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherCVE-2025-4760Fix available4.8 Medium
- wso2 api manager, micro integrator +1 moreInformation Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich MediatorCVE-2024-45986.5 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned FilesCVE-2024-35114.3 Medium
- wso2 api manager, identity server, identity server as key manager +3 more +5 moreOpen Redirection in Multiple WSO2 Products via Multi-Option Authentication EndpointCVE-2024-1440Fix available5.4 Medium
- wso2 api manager, enterprise integrator, identity server +7 more +9 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection ValidationCVE-2024-8008Fix available5.2 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreStored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text EditorCVE-2024-35094.3 Medium
- wso2 api manager, carbon synapse artifact uploader be, enterprise integrator +4 more +6 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code ExecutionCVE-2024-7074EPSS 17.7%6.8 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User SignupCVE-2024-70974.3 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 morePrivilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawCVE-2024-7096Fix available4.2 Medium
- wso2 api manager, identity server +1 moreReflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output EncodingCVE-2024-59626.1 Medium
- wso2 api manager, identity server, identity server as key manager +6 more +8 moreIncorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverCVE-2024-69149.8 Critical
- wso2 api manager, enterprise integrator, enterprise service bus +2 more +4 moreAn XML External Entity (XXE) vulnerability in Multiple WSO2 ProductsCVE-2025-2905Fix available9.1 Critical
- wso2 api manager, open banking am +1 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input ValidationCVE-2024-58486.1 Medium
- wso2 api manager, identity server +1 moreIncorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh TokenCVE-2024-23215.6 Medium
- wso2 api manager, api manager analytics, api microgateway +7 more +9 moreWSO2 Registry Stored Cross Site Scripting (XSS) vulnerabilityCVE-2023-6911Fix available4.8 Medium
- wso2 api managerDue to improper error handling, a REST API resource could expose a server side error containing...CVE-2023-68395.3 Medium
- wso2 api manager, identity server, identity server as key manager +1 more +3 moreReflected XSS vulnerability can be exploited by tampering a request parameter in Authentication...CVE-2023-68386.1 Medium
- wso2 api manager, carbon identity application authentication endpoint, carbon identity application authentication framework +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationCVE-2023-6837Fix available8.5 High
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 products vulnerable to XML External Entity attackCVE-2023-6836Fix available4.6 Medium
- wso2 api manager, iot server +1 moreWSO2 API Manager allows attackers to change the API ratingCVE-2023-68354.3 Medium