Priority LOW 23
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00141 · Published 2026-08-06 · Fixed in 5.10.0.381, 5.11.0.428 +106 CWE-352
Priority MEDIUM 40
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Car…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00249 · Published 2025-11-18 · Fixed in 2.0.0, 4.5.0.34 +38 CWE-352
Priority LOW 27
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00194 · Published 2025-11-05 · Fixed in 2.0.0.413, 3.1.0.344 +51 CWE-79
Priority LOW 39
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines.
CVSS 3.1HIGH 8.4· Adjacent network · High privileges · No interaction · EPSS 0.00471 · Published 2025-11-05 · Fixed in 4.0.0.145, 4.1.0.147 +30 CWE-94
Priority LOW 39
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services.
CVSS 3.1HIGH 8.4· Adjacent network · High privileges · No interaction · EPSS 0.00596 · Published 2025-11-05 · Fixed in 3.1.0.345, 3.2.0.448 +66 CWE-434
Priority MEDIUM 42
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00455 · Published 2025-11-05 · Fixed in 6.6.0.223, 4.5.0.27 +26 CWE-611
Priority MEDIUM 41
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00909 · Published 2025-11-05 · Fixed in 5.10.0.360, 5.11.0.399 +25 CWE-434
Priority LOW 26
An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0085 · Published 2025-10-24 · Fixed in 5.10.0.361, 5.11.0.414 +34 CWE-290
Priority LOW 27
SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users.
CVSS 3.1MEDIUM 5.9· Adjacent network · High privileges · No interaction · EPSS 0.00616 · Published 2025-10-24 · Fixed in 5.10.0.359, 5.11.0.415 +33 CWE-79
Priority MEDIUM 44
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs.
CVSS 3.1CRITICAL 9.6· Adjacent network · No auth · No interaction · EPSS 0.00572 · Published 2025-10-16 · Fixed in 5.3.0.41, 5.5.0.53 +130 CWE-284
Priority LOW 25
An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration.
CVSS 3.1MEDIUM 5.7· Adjacent network · Low privileges · No interaction · EPSS 0.00212 · Published 2025-10-16 · Fixed in 6.0.0.22, 6.1.0.39 +17 CWE-863
Priority LOW 34
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00539 · Published 2025-09-26 · Fixed in 6.6.0.215, 5.10.0.347 +5 CWE-434
Priority LOW 19
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry.
CVSS 3.1MEDIUM 4.3· Adjacent network · No auth · No interaction · EPSS 0.00208 · Published 2025-06-23 · Fixed in 6.6.0.205, 3.1.0.273 +27 CWE-863
Priority LOW 24
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request.
CVSS 3.1MEDIUM 5.2· Adjacent network · No auth · User interaction · EPSS 0.00553 · Published 2025-06-02 · Fixed in 6.6.0.211, 3.1.0.305 +32 CWE-79
Priority LOW 19
A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section.
CVSS 3.1MEDIUM 4.3· Adjacent network · High privileges · User interaction · EPSS 0.00206 · Published 2025-06-02 · Fixed in 6.6.0.202, 3.1.0.275 +27 CWE-79
Priority LOW 23
A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00146 · Published 2025-02-27 · Fixed in 6.6.0.179 CWE-352
Priority LOW 22
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feat…
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00406 · Published 2023-12-18 · Fixed in 2.2.0.1, 2.5.0.1 +23 CWE-79
Priority LOW 33
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00482 · Published 2023-12-15 · Fixed in 3.0.0.1, 2.2.0.1 +18 CWE-611
Priority MEDIUM 61
An issue was discovered in WSO2 Enterprise Integrator 6.4.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.58322 · Published 2022-09-09 · No fix listed CWE-79
Priority LOW 28
An issue was discovered in WSO2 Enterprise Integrator 6.4.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00563 · Published 2022-09-09 · No fix listed CWE-79
Priority MEDIUM 55
A reflected XSS issue exists in the Management Console of several WSO2 products.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.41078 · Published 2022-04-21 · No fix listed CWE-79
Priority CRITICAL 100KEV
Certain WSO2 products allow unrestricted file upload with resultant remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99999 · Published 2022-04-18 · No fix listed CWE-22
Priority MEDIUM 49
WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.26225 · Published 2021-04-05 · No fix listed CWE-79
Priority LOW 25
WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00588 · Published 2020-10-29 · No fix listed CWE-79
Priority LOW 28
An issue was discovered in certain WSO2 products.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00722 · Published 2020-08-27 · No fix listed CWE-79
Load more
THREATIST.IORead the docs