Read the docs

WSO2

Records187All Threatist records
Exploited (KEV)2In CISA KEV
CVSS critical23CVSS 9.0–10.0
CVSS high36CVSS 7.0–8.9

Exploited now

WSO2 records in CISA KEV
TI-2026-04755 WSO2 Multiple Products Path Traversal Vulnerability Priority CRITICAL 100KEV 2026-09-24TI-2022-11928 WSO2 Multiple Products Unrestrictive Upload of File Vulnerability Priority CRITICAL 100KEV 2022-04-25

Components

Products in the NVD configurations · select one to filter the records
Api Manager 95 records CRITICAL Identity Server 83 records CRITICAL Identity Server As Key Manager 52 records CRITICAL Enterprise Integrator 33 records CRITICAL Open Banking Iam 33 records CRITICAL Api Control Plane 31 records CRITICAL Traffic Manager 27 records CRITICAL Open Banking Am 26 records CRITICAL

Records

33 records in Enterprise Integrator · all components

TI-2025-08993 CVE-2025-9804 · GHSA-rrm7-q958-j87q

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

Priority MEDIUM 44

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs.

CVSS 3.1CRITICAL 9.6 Adjacent network No auth No interaction EPSS 0.00572 Published 2025-10-16 Fixed in 5.3.0.41, 5.5.0.53 +130 CWE-284
TI-2025-02730 CVE-2025-3125 · GHSA-mg7h-mgjw-mg5g

Unrestricted file upload in WSO2 Identity Server

Priority MEDIUM 41

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00909 Published 2025-11-05 Fixed in 5.10.0.360, 5.11.0.399 +25 CWE-434
TI-2025-06059 CVE-2025-6670 · GHSA-w28c-j5m7-w8fm

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

Priority MEDIUM 40

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Car…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00249 Published 2025-11-18 Fixed in 2.0.0, 4.5.0.34 +38 CWE-352
TI-2025-10161 CVE-2025-11093 · GHSA-qfqc-4pqq-rfmh

Code injection in WSO2 Micro Integrator

Priority LOW 39

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines.

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.00471 Published 2025-11-05 Fixed in 4.0.0.145, 4.1.0.147 +30 CWE-94
TI-2025-09987 CVE-2025-10907 · GHSA-fc89-q8rg-m49m

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution

Priority LOW 39

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services.

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.00596 Published 2025-11-05 Fixed in 3.1.0.345, 3.2.0.448 +66 CWE-434
TI-2025-01607 CVE-2025-1862 · GHSA-hwxg-x5fm-7m92

Unrestricted file upload in WSO2 Enterprise Integrator

Priority LOW 34

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00539 Published 2025-09-26 Fixed in 6.6.0.215, 5.10.0.347 +5 CWE-434
TI-2020-10113 CVE-2020-12719 · GHSA-q7x3-rwx8-4wrg

XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager…

Priority LOW 34

XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as K…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01034 Published 2020-05-07 No fix listed CWE-611
TI-2023-06241 CVE-2023-6836 · GHSA-cr8h-fr86-8vfv

XML external entity injection in WSO2 API Manager

Priority LOW 33

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00482 Published 2023-12-15 Fixed in 3.0.0.1, 2.2.0.1 +18 CWE-611
TI-2017-10747 CVE-2017-14651 · GHSA-9vxr-rfwq-jvg8

WSO2 Data Analytics Server 3.1.0 has XSS in…

Priority LOW 29

WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.03836 Published 2017-09-21 No fix listed CWE-79
TI-2025-05045 CVE-2025-5605 · GHSA-p2f5-h899-464p

Authentication bypass by spoofing in WSO2 Identity Server

Priority LOW 26

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0085 Published 2025-10-24 Fixed in 5.10.0.361, 5.11.0.414 +34 CWE-290
TI-2025-09136 CVE-2025-9955 · GHSA-96gj-mh52-m33j

Incorrect authorization in WSO2 Enterprise Integrator

Priority LOW 25

An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration.

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.00212 Published 2025-10-16 Fixed in 6.0.0.22, 6.1.0.39 +17 CWE-863
Load more
Open these records in search →