Advisories · Technology

WSO2 API Manager.

Every CVE that names WSO2 API Manager among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-6670 CVE record

CVSS 8.8 High

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
- WSO2 Open Banking AM
- WSO2 Open Banking IAM
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-10853 CVE record

CVSS 5.2 Medium

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
- WSO2 Open Banking IAM
- WSO2 API Manager
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2025
CVE-2025-5770 CVE record

CVSS 6.1 Medium

Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 API Manager
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2025
CVE-2025-11093 CVE record

CVSS 8.4 High

Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
- WSO2 Micro Integrator
- WSO2 API Manager
- Code injection
Not analysed yet 5 Nov 2025
CVE-2025-10907 CVE record

CVSS 8.4 High

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
- WSO2 API Manager
- WSO2 Open Banking IAM
- Unrestricted file upload
Not analysed yet 5 Nov 2025
CVE-2025-3125 CVE record

CVSS 6.7 Medium

Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Unrestricted file upload
Not analysed yet 5 Nov 2025
CVE-2025-5605 CVE record

CVSS 4.3 Medium

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Authentication bypass
Not analysed yet 24 Oct 2025
CVE-2025-5350 CVE record

CVSS 5.9 Medium

SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
Not analysed yet 24 Oct 2025
CVE-2025-9152 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
- WSO2 API Manager
- WSO2 API Control Plane
- Authentication bypass
Not analysed yet 16 Oct 2025
CVE-2025-9804 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Broken access control
Not analysed yet 16 Oct 2025
CVE-2025-10611 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
- WSO2 API Manager
- WSO2 API Control Plane
- Broken access control
Not analysed yet 16 Oct 2025
CVE-2025-5717 CVE record

CVSS 6.8 Medium

Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
- WSO2 API Manager
- WSO2 Open Banking AM
- Code injection
Not analysed yet 23 Sept 2025
CVE-2024-4598 CVE record

CVSS 6.5 Medium

Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator
- WSO2 API Manager
- WSO2 Micro Integrator
- CWE-1259
Not analysed yet 23 Sept 2025
CVE-2024-3511 CVE record

CVSS 4.3 Medium

Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Broken access control
Not analysed yet 23 Jun 2025
CVE-2024-3509 CVE record

CVSS 4.3 Medium

Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Cross-site scripting (XSS)
Not analysed yet 2 Jun 2025
CVE-2024-7074 CVE record

CVSS 6.8 Medium

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Unrestricted file upload
Not analysed yet 2 Jun 2025
CVE-2024-7097 CVE record

CVSS 4.3 Medium

Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
- WSO2 Open Banking AM
- WSO2 Open Banking KM
- Broken access control
Not analysed yet 30 May 2025
CVE-2024-5962 CVE record

CVSS 6.1 Medium

Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding
- WSO2 API Manager
- WSO2 Identity Server
- Cross-site scripting (XSS)
Not analysed yet 22 May 2025
CVE-2024-6914 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- WSO2 API Manager
- WSO2 Governance Registry
- Broken access control
Not analysed yet 22 May 2025
CVE-2024-5848 CVE record

CVSS 6.1 Medium

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation
- WSO2 API Manager
- WSO2 Open Banking AM
- Cross-site scripting (XSS)
Not analysed yet 27 Feb 2025
CVE-2023-6839 CVE record

CVSS 5.3 Medium

Sensitive information in error messages in WSO2 API Manager
- WSO2 API Manager
- Information disclosure
Not analysed yet 15 Dec 2023
CVE-2023-6838 CVE record

CVSS 6.1 Medium

Cross-site scripting in WSO2 API Manager and others
- WSO2 API Manager
- WSO2 Identity Server
- Cross-site scripting (XSS)
Not analysed yet 15 Dec 2023