WSO2 vulnerabilities
131 CVEs and advisories name WSO2 as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-10713XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
- CVE-2025-3125Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
- CVE-2025-5605Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
- CVE-2025-5350SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
- CVE-2025-9152Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
- CVE-2025-9804Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
- CVE-2025-9955Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration
- CVE-2025-10611Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
- CVE-2025-1862Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
- CVE-2025-1396Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled
- CVE-2025-0672Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association
- CVE-2025-0209Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server Account Registration Flow
- CVE-2025-0663Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login
- CVE-2024-6429Content Spoofing in Multiple WSO2 Products via Error Message Injection
- CVE-2025-5717Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
- CVE-2025-4760Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher
- CVE-2024-4598Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator
- CVE-2024-3511Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
- CVE-2024-1440Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint
- CVE-2024-8008Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
- CVE-2024-3509Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
- CVE-2024-7074Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
- CVE-2024-7073Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
- CVE-2024-7097Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
- CVE-2024-7096Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
- CVE-2024-5962Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding
- CVE-2024-7487Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication
- CVE-2024-7103Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login Flow
- CVE-2024-6914Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- CVE-2025-2905An XML External Entity (XXE) vulnerability in Multiple WSO2 Products