Vulnerabilities in WSO2
131 resultsCVE-2026-3096MEDIUMReverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential TheftEPSS 0.3%CVE-2025-14260HIGHServer Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External ResourcesEPSS 0.3%CVE-2025-6508MEDIUMUser Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended RequestsEPSS 0.3%CVE-2025-0326HIGHImproper Token Revocation in WSO2 Identity Server Allows Unauthorized AccessEPSS 0.3%CVE-2025-13475LOWCross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data ExposureEPSS 0.3%CVE-2024-8010LOWXML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary FilesEPSS 0.3%CVE-2025-13166LOWUsername Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account DiscoveryEPSS 0.3%CVE-2025-13736LOWUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.3%CVE-2025-6623MEDIUMStored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and RedirectionEPSS 0.3%CVE-2026-3583LOWImproper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]EPSS 0.3%CVE-2024-5962MEDIUMReflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output EncodingEPSS 0.3%CVE-2024-8122MEDIUMPotential brute force vulnerability due to non-expiring SMS OTPsEPSS 0.3%CVE-2026-2445MEDIUMReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and ModificationEPSS 0.3%CVE-2025-8591MEDIUMReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI ModificationEPSS 0.3%CVE-2025-1396LOWUsername Enumeration in Multiple WSO2 Products with Multi-Attribute Login EnabledEPSS 0.3%CVE-2025-12317MEDIUMImproper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access PrivilegesEPSS 0.3%CVE-2025-9312CRITICALImproper Certificate-Based Authentication Enforcement in Multiple WSO2 ProductsEPSS 0.3%CVE-2025-6670HIGHCross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin ServicesEPSS 0.2%CVE-2024-2321MEDIUMIncorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh TokenEPSS 0.2%CVE-2025-0663MEDIUMPotential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-LoginEPSS 0.2%