Vulnerabilities in WSO2
131 resultsCVE-2024-10242MEDIUMReflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and RedirectionEPSS 0.2%CVE-2024-1440MEDIUMOpen Redirection in Multiple WSO2 Products via Multi-Option Authentication EndpointEPSS 0.2%CVE-2024-7478MEDIUMUsername Enumeration via External User Stores in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%CVE-2025-0209MEDIUMReflected Cross-Site Scripting (XSS) in WSO2 Identity Server Account Registration FlowEPSS 0.2%CVE-2024-7073MEDIUMUnauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin ServicesEPSS 0.2%CVE-2024-5848MEDIUMReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input ValidationEPSS 0.2%CVE-2025-6024MEDIUMCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious WebsitesEPSS 0.2%CVE-2025-10908HIGHAccount Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized AccessEPSS 0.2%CVE-2024-2323MEDIUMPassword Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%CVE-2024-7103MEDIUMReflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login FlowEPSS 0.2%CVE-2024-5139MEDIUMCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and RedirectionEPSS 0.2%CVE-2024-5617MEDIUMAccount Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force AttacksEPSS 0.2%CVE-2025-0672LOWAuthentication Bypass in Multiple WSO2 Products via Stale FIDO Credential AssociationEPSS 0.2%CVE-2024-6429MEDIUMContent Spoofing in Multiple WSO2 Products via Error Message InjectionEPSS 0.2%CVE-2024-12139MEDIUMContent Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering AttacksEPSS 0.2%CVE-2026-11854MEDIUMCross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 ProductsEPSS 0.2%CVE-2025-5770MEDIUMReflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 ProductsEPSS 0.2%CVE-2026-6647HIGHIncomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle EventsEPSS 0.2%CVE-2025-9955MEDIUMImproper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store ConfigurationEPSS 0.2%CVE-2024-3511MEDIUMIncorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned FilesEPSS 0.2%