# cve.now: WSO2

The newest entries naming WSO2 as an affected vendor (up to 200), of 131 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-11229](https://cve.now/CVE-2025-11229.md): Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server (CVSS 7.2)
- [CVE-2026-4052](https://cve.now/CVE-2026-4052.md): Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) (CVSS 9.8)
- [CVE-2025-5769](https://cve.now/CVE-2025-5769.md): Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification (CVSS 6.1)
- [CVE-2025-1397](https://cve.now/CVE-2025-1397.md): Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled… (CVSS 4.8)
- [CVE-2024-12139](https://cve.now/CVE-2024-12139.md): Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks (CVSS 4.3)
- [CVE-2024-12141](https://cve.now/CVE-2024-12141.md): Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks (CVSS 4.3)
- [CVE-2024-9517](https://cve.now/CVE-2024-9517.md): Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts (CVSS 4.9)
- [CVE-2024-2372](https://cve.now/CVE-2024-2372.md): Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks (CVSS 5.4)
- [CVE-2025-12544](https://cve.now/CVE-2025-12544.md): Stored Cross-Site Scripting in Multiple WSO2 Products (CVSS 4.8)
- [CVE-2026-2613](https://cve.now/CVE-2026-2613.md): SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption (CVSS 8.7)
- [CVE-2026-18800](https://cve.now/CVE-2026-18800.md): Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data (CVSS 4.4)
- [CVE-2025-13647](https://cve.now/CVE-2025-13647.md): Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths (CVSS 5.8)
- [CVE-2024-7075](https://cve.now/CVE-2024-7075.md): Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products (CVSS 4.6)
- [CVE-2024-5617](https://cve.now/CVE-2024-5617.md): Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks (CVSS 4.8)
- [CVE-2025-11969](https://cve.now/CVE-2025-11969.md): Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions (CVSS 9.4)
- [CVE-2026-78674](https://cve.now/CVE-2026-78674.md): Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution (CVSS 8.8)
- [CVE-2026-6647](https://cve.now/CVE-2026-6647.md): Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events (CVSS 7.4)
- [CVE-2026-3583](https://cve.now/CVE-2026-3583.md): Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products \[Disrupted Authentication Flows\] (CVSS 3.1)
- [CVE-2026-11854](https://cve.now/CVE-2026-11854.md): Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products (CVSS 6.1)
- [CVE-2025-14260](https://cve.now/CVE-2025-14260.md): Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources (CVSS 8.3)
- [CVE-2024-6423](https://cve.now/CVE-2024-6423.md): Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage (CVSS 4.0)
- [CVE-2025-0326](https://cve.now/CVE-2025-0326.md): Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access (CVSS 7.4)
- [CVE-2024-7478](https://cve.now/CVE-2024-7478.md): Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.8)
- [CVE-2024-5563](https://cve.now/CVE-2024-5563.md): Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks (CVSS 4.8)
- [CVE-2024-4989](https://cve.now/CVE-2024-4989.md): Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks (CVSS 5.4)
- [CVE-2024-5139](https://cve.now/CVE-2024-5139.md): Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection (CVSS 6.1)
- [CVE-2024-2323](https://cve.now/CVE-2024-2323.md): Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery (CVSS 4.8)
- [CVE-2024-4412](https://cve.now/CVE-2024-4412.md): Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations (CVSS 2.7)
- [CVE-2025-13173](https://cve.now/CVE-2025-13173.md): Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination (CVSS 6.5)
- [CVE-2025-13591](https://cve.now/CVE-2025-13591.md): Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery (CVSS 5.3)
- [CVE-2025-10149](https://cve.now/CVE-2025-10149.md): Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover (CVSS 8.2)
- [CVE-2025-7203](https://cve.now/CVE-2025-7203.md): Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials (CVSS 4.9)
- [CVE-2025-7043](https://cve.now/CVE-2025-7043.md): Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption (CVSS 5.4)
- [CVE-2025-6623](https://cve.now/CVE-2025-6623.md): Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection (CVSS 4.3)
- [CVE-2024-4457](https://cve.now/CVE-2024-4457.md): Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution (CVSS 9.1)
- [CVE-2024-8122](https://cve.now/CVE-2024-8122.md): Potential brute force vulnerability due to non-expiring SMS OTPs (CVSS 5.9)
- [CVE-2025-13166](https://cve.now/CVE-2025-13166.md): Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery (CVSS 3.7)
- [CVE-2025-5802](https://cve.now/CVE-2025-5802.md): Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.3)
- [CVE-2026-19515](https://cve.now/CVE-2026-19515.md): OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution (CVSS 7.0)
- [CVE-2026-4103](https://cve.now/CVE-2026-4103.md): Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution (CVSS 6.4)
- [CVE-2026-3096](https://cve.now/CVE-2026-3096.md): Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft (CVSS 4.7)
- [CVE-2025-12737](https://cve.now/CVE-2025-12737.md): Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution (CVSS 8.4)
- [CVE-2026-3416](https://cve.now/CVE-2026-3416.md): Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads (CVSS 5.9)
- [CVE-2026-3418](https://cve.now/CVE-2026-3418.md): Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution (CVSS 9.1)
- [CVE-2026-3415](https://cve.now/CVE-2026-3415.md): XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service (CVSS 8.7)
- [CVE-2025-14561](https://cve.now/CVE-2025-14561.md): Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations (CVSS 9.0)
- [CVE-2025-12317](https://cve.now/CVE-2025-12317.md): Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges (CVSS 5.0)
- [CVE-2025-6508](https://cve.now/CVE-2025-6508.md): User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests (CVSS 4.3)
- [CVE-2024-6541](https://cve.now/CVE-2024-6541.md): Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products (CVSS 6.8)
- [CVE-2026-5430](https://cve.now/CVE-2026-5430.md): Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover (CVSS 10.0, KEV)
- [CVE-2026-1728](https://cve.now/CVE-2026-1728.md): Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover (CVSS 9.8)
- [CVE-2025-15039](https://cve.now/CVE-2025-15039.md): Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products (CVSS 9.4)
- [CVE-2026-0637](https://cve.now/CVE-2026-0637.md): Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery (CVSS 5.4)
- [CVE-2025-13394](https://cve.now/CVE-2025-13394.md): Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions (CVSS 5.4)
- [CVE-2025-13909](https://cve.now/CVE-2025-13909.md): Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure (CVSS 4.3)
- [CVE-2025-12627](https://cve.now/CVE-2025-12627.md): Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions (CVSS 2.4)
- [CVE-2025-14779](https://cve.now/CVE-2025-14779.md): Improper Access Control via Secret Type Management API in WSO2 Identity Server (CVSS 3.8)
- [CVE-2025-11850](https://cve.now/CVE-2025-11850.md): Improper Implicit Association via User Store Initialization in WSO2 Identity Server \[Identity Confusion / External IDP Use\] (CVSS 4.3)
- [CVE-2025-13736](https://cve.now/CVE-2025-13736.md): Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery (CVSS 3.7)
- [CVE-2024-10302](https://cve.now/CVE-2024-10302.md): Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure (CVSS 4.0)
- [CVE-2024-6832](https://cve.now/CVE-2024-6832.md): Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks (CVSS 5.9)
- [CVE-2024-8995](https://cve.now/CVE-2024-8995.md): Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access (CVSS 4.9)
- [CVE-2026-2445](https://cve.now/CVE-2026-2445.md): Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification (CVSS 6.1)
- [CVE-2026-4249](https://cve.now/CVE-2026-4249.md): Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption (CVSS 8.6)
- [CVE-2025-8591](https://cve.now/CVE-2025-8591.md): Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification (CVSS 6.1)
- [CVE-2024-1248](https://cve.now/CVE-2024-1248.md): Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation (CVSS 4.8)
- [CVE-2025-13475](https://cve.now/CVE-2025-13475.md): Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure (CVSS 3.5)
- [CVE-2026-2053](https://cve.now/CVE-2026-2053.md): Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager (CVSS 8.3)
- [CVE-2025-10470](https://cve.now/CVE-2025-10470.md): Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability (CVSS 8.6)
- [CVE-2025-9973](https://cve.now/CVE-2025-9973.md): Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover (CVSS 6.4)
- [CVE-2025-8325](https://cve.now/CVE-2025-8325.md): Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations (CVSS 6.3)
- [CVE-2025-8154](https://cve.now/CVE-2025-8154.md): HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation (CVSS 5.3)
- [CVE-2025-10908](https://cve.now/CVE-2025-10908.md): Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access (CVSS 7.3)
- [CVE-2024-0391](https://cve.now/CVE-2024-0391.md): Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.3)
- [CVE-2025-10503](https://cve.now/CVE-2025-10503.md): Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server (CVSS 6.1)
- [CVE-2025-12624](https://cve.now/CVE-2025-12624.md): Improper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock (CVSS 6.0)
- [CVE-2025-6024](https://cve.now/CVE-2025-6024.md): Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites (CVSS 6.1)
- [CVE-2024-10242](https://cve.now/CVE-2024-10242.md): Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection (CVSS 6.1)
- [CVE-2024-8010](https://cve.now/CVE-2024-8010.md): XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files (CVSS 3.5)
- [CVE-2024-4867](https://cve.now/CVE-2024-4867.md): Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval (CVSS 5.4)
- [CVE-2024-2374](https://cve.now/CVE-2024-2374.md): XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service (CVSS 7.5)
- [CVE-2024-1524](https://cve.now/CVE-2024-1524.md): A local user can be impersonated when using federated authentication with Silent JIT Provisioning. (CVSS 7.7)
- [CVE-2025-13590](https://cve.now/CVE-2025-13590.md): Authenticated arbitrary file upload via a System REST API requiring administrator permission. (CVSS 9.1)
- [CVE-2025-12107](https://cve.now/CVE-2025-12107.md): Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution (CVSS 8.4)
- [CVE-2025-9312](https://cve.now/CVE-2025-9312.md): Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products (CVSS 9.8)
- [CVE-2025-6670](https://cve.now/CVE-2025-6670.md): Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services (CVSS 8.8)
- [CVE-2025-10853](https://cve.now/CVE-2025-10853.md): Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding (CVSS 5.2)
- [CVE-2025-5770](https://cve.now/CVE-2025-5770.md): Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products (CVSS 6.1)
- [CVE-2025-11093](https://cve.now/CVE-2025-11093.md): Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) (CVSS 8.4)
- [CVE-2025-10907](https://cve.now/CVE-2025-10907.md): Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution (CVSS 8.4)
- [CVE-2025-10713](https://cve.now/CVE-2025-10713.md): XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration (CVSS 6.5)
- [CVE-2025-3125](https://cve.now/CVE-2025-3125.md): Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution (CVSS 6.7)
- [CVE-2025-5605](https://cve.now/CVE-2025-5605.md): Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure (CVSS 4.3)
- [CVE-2025-5350](https://cve.now/CVE-2025-5350.md): SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products (CVSS 5.9)
- [CVE-2025-9152](https://cve.now/CVE-2025-9152.md): Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint (CVSS 9.8)
- [CVE-2025-9804](https://cve.now/CVE-2025-9804.md): Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs (CVSS 9.6)
- [CVE-2025-9955](https://cve.now/CVE-2025-9955.md): Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration (CVSS 5.7)
- [CVE-2025-10611](https://cve.now/CVE-2025-10611.md): Potential Broken Access Control in Multiple WSO2 Products via System REST APIs (CVSS 9.8)
- [CVE-2025-1862](https://cve.now/CVE-2025-1862.md): Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution (CVSS 6.7)
- [CVE-2025-1396](https://cve.now/CVE-2025-1396.md): Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled (CVSS 3.7)
- [CVE-2025-0672](https://cve.now/CVE-2025-0672.md): Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association (CVSS 3.3)
- [CVE-2025-0209](https://cve.now/CVE-2025-0209.md): Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server Account Registration Flow (CVSS 6.1)
- [CVE-2025-0663](https://cve.now/CVE-2025-0663.md): Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login (CVSS 6.8)
- [CVE-2024-6429](https://cve.now/CVE-2024-6429.md): Content Spoofing in Multiple WSO2 Products via Error Message Injection (CVSS 4.3)
- [CVE-2025-5717](https://cve.now/CVE-2025-5717.md): Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service (CVSS 6.8)
- [CVE-2025-4760](https://cve.now/CVE-2025-4760.md): Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher (CVSS 4.8)
- [CVE-2024-4598](https://cve.now/CVE-2024-4598.md): Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator (CVSS 6.5)
- [CVE-2024-3511](https://cve.now/CVE-2024-3511.md): Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files (CVSS 4.3)
- [CVE-2024-1440](https://cve.now/CVE-2024-1440.md): Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint (CVSS 5.4)
- [CVE-2024-8008](https://cve.now/CVE-2024-8008.md): Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation (CVSS 5.2)
- [CVE-2024-3509](https://cve.now/CVE-2024-3509.md): Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor (CVSS 4.3)
- [CVE-2024-7074](https://cve.now/CVE-2024-7074.md): Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution (CVSS 6.8)
- [CVE-2024-7073](https://cve.now/CVE-2024-7073.md): Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services (CVSS 6.5)
- [CVE-2024-7097](https://cve.now/CVE-2024-7097.md): Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup (CVSS 4.3)
- [CVE-2024-7096](https://cve.now/CVE-2024-7096.md): Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw (CVSS 4.2)
- [CVE-2024-5962](https://cve.now/CVE-2024-5962.md): Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding (CVSS 6.1)
- [CVE-2024-7487](https://cve.now/CVE-2024-7487.md): Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication (CVSS 5.8)
- [CVE-2024-7103](https://cve.now/CVE-2024-7103.md): Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login Flow (CVSS 4.6)
- [CVE-2024-6914](https://cve.now/CVE-2024-6914.md): Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover (CVSS 9.8)
- [CVE-2025-2905](https://cve.now/CVE-2025-2905.md): An XML External Entity (XXE) vulnerability in Multiple WSO2 Products (CVSS 9.1)
- [CVE-2024-5848](https://cve.now/CVE-2024-5848.md): Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation (CVSS 6.1)
- [CVE-2024-0392](https://cve.now/CVE-2024-0392.md): Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation (CVSS 5.4)
- [CVE-2024-2321](https://cve.now/CVE-2024-2321.md): Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token (CVSS 5.6)
- [CVE-2023-6911](https://cve.now/CVE-2023-6911.md): Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be (CVSS 4.8)
- [CVE-2023-6839](https://cve.now/CVE-2023-6839.md): Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in th (CVSS 5.3)
- [CVE-2023-6838](https://cve.now/CVE-2023-6838.md): Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. (CVSS 6.1)
- [CVE-2023-6837](https://cve.now/CVE-2023-6837.md): Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation (CVSS 8.5)
- [CVE-2023-6836](https://cve.now/CVE-2023-6836.md): Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely us (CVSS 4.6)
- [CVE-2023-6835](https://cve.now/CVE-2023-6835.md): Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could (CVSS 4.3)
- [CVE-2022-4521](https://cve.now/CVE-2022-4521.md): WSO2 carbon-registry Request Parameter cross site scripting (CVSS 3.5)
- [CVE-2022-4520](https://cve.now/CVE-2022-4520.md): WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting (CVSS 3.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wso2
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.