Vulnerabilities

TI-2025-09942 CVE-2025-10853 · GHSA-4x6x-rggp-ff9q

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

LOW 27

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00194 Published 2025-11-05 Fixed in 2.0.0.413, 3.1.0.344 +51 CWE-79

TI-2025-09807 CVE-2025-10713 · GHSA-fvfq-q238-j7j3

MEDIUM 42

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00455 Published 2025-11-05 Fixed in 6.6.0.223, 4.5.0.27 +26 CWE-611