Skip to contentWso2 vulnerabilities
Products
Show 7 moreShow less
Newest
- wso2 identity server, identity server as key manager, open banking iam +2 moreAuthentication Bypass in Multiple WSO2 Products via Stale FIDO Credential AssociationCVE-2025-06723.3 Low
- wso2 identity serverReflected Cross-Site Scripting (XSS) in WSO2 Identity Server Account Registration FlowCVE-2025-02096.1 Medium
- wso2 identity server, identity server as key manager, open banking iam +2 morePotential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-LoginCVE-2025-06636.8 Medium
- wso2 api manager, identity server, identity server as key manager +2 moreContent Spoofing in Multiple WSO2 Products via Error Message InjectionCVE-2024-6429Fix available4.3 Medium
- wso2 api control plane, api manager, open banking am +2 more +4 moreAuthenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin ServiceCVE-2025-57176.8 Medium
- wso2 api control plane, api manager, traffic manager +2 more +4 moreAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherCVE-2025-4760Fix available4.8 Medium
- wso2 api manager, micro integrator +1 moreInformation Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich MediatorCVE-2024-45986.5 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned FilesCVE-2024-35114.3 Medium
- wso2 api manager, identity server, identity server as key manager +3 more +5 moreOpen Redirection in Multiple WSO2 Products via Multi-Option Authentication EndpointCVE-2024-1440Fix available5.4 Medium
- wso2 api manager, enterprise integrator, identity server +7 more +9 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection ValidationCVE-2024-8008Fix available5.2 Medium
- wso2 api manager, enterprise integrator, identity server +4 more +6 moreStored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text EditorCVE-2024-35094.3 Medium
- wso2 api manager, carbon synapse artifact uploader be, enterprise integrator +4 more +6 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code ExecutionCVE-2024-7074EPSS 17.7%6.8 Medium
- wso2 identity server, identity server as key manager, open banking iam +2 more +4 moreUnauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin ServicesCVE-2024-70736.5 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User SignupCVE-2024-70974.3 Medium
- wso2 api manager, identity server, identity server as key manager +4 more +6 morePrivilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawCVE-2024-7096Fix available4.2 Medium
- wso2 api manager, identity server +1 moreReflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output EncodingCVE-2024-59626.1 Medium
- wso2 identity server, client attestation filter, carbon identity client attestation met data mgt be +2 moreImproper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native AuthenticationCVE-2024-74875.8 Medium
- wso2 identity serverReflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login FlowCVE-2024-71034.6 Medium
- wso2 api manager, identity server, identity server as key manager +6 more +8 moreIncorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverCVE-2024-69149.8 Critical
- wso2 api manager, enterprise integrator, enterprise service bus +2 more +4 moreAn XML External Entity (XXE) vulnerability in Multiple WSO2 ProductsCVE-2025-2905Fix available9.1 Critical
- wso2 api manager, open banking am +1 moreReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input ValidationCVE-2024-58486.1 Medium
- wso2 enterprise integratorCross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token ValidationCVE-2024-03925.4 Medium
- wso2 api manager, identity server +1 moreIncorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh TokenCVE-2024-23215.6 Medium
- wso2 api manager, api manager analytics, api microgateway +7 more +9 moreWSO2 Registry Stored Cross Site Scripting (XSS) vulnerabilityCVE-2023-6911Fix available4.8 Medium
- wso2 api managerDue to improper error handling, a REST API resource could expose a server side error containing...CVE-2023-68395.3 Medium
- wso2 api manager, identity server, identity server as key manager +1 more +3 moreReflected XSS vulnerability can be exploited by tampering a request parameter in Authentication...CVE-2023-68386.1 Medium
- wso2 api manager, carbon identity application authentication endpoint, carbon identity application authentication framework +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationCVE-2023-6837Fix available8.5 High
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 products vulnerable to XML External Entity attackCVE-2023-6836Fix available4.6 Medium
- wso2 api manager, iot server +1 moreWSO2 API Manager allows attackers to change the API ratingCVE-2023-68354.3 Medium
- wso2 api managerA reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2...CVE-2023-31664Public exploit6.1 Medium
- wso2 carbon-registryWSO2 carbon-registry Request Parameter cross site scriptingCVE-2022-4521Fix available3.5 Low
- wso2 carbon-registryWSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scriptingCVE-2022-4520Fix available3.5 Low
- wso2 enterprise integratorAn issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting ...CVE-2022-39810EPSS 58.3%6.1 Medium
- wso2 enterprise integratorAn issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting ...CVE-2022-398096.1 Medium
- wso2 api manager, identity server, identity server as key manager +2 moreXML External Entity (XXE) vulnerability in the file based service provider creation feature of...CVE-2021-426469.1 Critical
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreA reflected XSS issue exists in the Management Console of several WSO2 products. This affects API...CVE-2022-29548Public exploitEPSS 41.1%4.6 Medium
- wso2 api manager, enterprise integrator, identity server +6 more +8 moreCertain WSO2 products allow unrestricted file upload with resultant remote code execution. This...CVE-2022-29464In KEVPublic exploitEPSS 100.0%9.8 Critical
- wso2 identity server, api manager, identity server as key manager +1 more +3 moreIn accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to...CVE-2021-367606.1 Medium
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.CVE-2020-17453Public exploitEPSS 26.2%6.1 Medium
- wso2 api managerCross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site...CVE-2020-278856.1 Medium
- wso2 enterprise integratorWSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS)...CVE-2020-255165.4 Medium
- wso2 api managerWSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin...CVE-2020-174546.1 Medium
- wso2 api manager, api manager analytics, identity server +3 more +5 moreAn issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This...CVE-2020-247066.1 Medium
- wso2 api manager, api manager analytics, identity server +3 more +5 moreAn issue was discovered in certain WSO2 products. A valid Carbon Management Console session...CVE-2020-247058.8 High
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreAn issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This...CVE-2020-247046.1 Medium
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreAn issue was discovered in certain WSO2 products. A valid Carbon Management Console session...CVE-2020-247038.8 High
- wso2 api manager, api microgateway +1 moreThe Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML...CVE-2020-24589EPSS 26.3%9.1 Critical
- wso2 api manager, api manager analytics, api microgateway +2 more +4 moreThe Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates....CVE-2020-245916.5 Medium
- wso2 api manager, api microgateway +1 moreThe Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML...CVE-2020-245909.1 Critical
- wso2 identity server, identity server as key manager +1 moreAn issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through...CVE-2020-144445.4 Medium
- Show moreLoading…