Vulnerabilities in WSO2
131 resultsCVE-2024-3509MEDIUMStored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text EditorEPSS 0.2%CVE-2025-12627LOWImproper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsEPSS 0.2%CVE-2024-12141MEDIUMOpen Redirect via Callback URL Validation in WSO2 Products Allows Phishing AttacksEPSS 0.2%CVE-2025-12544MEDIUMStored Cross-Site Scripting in Multiple WSO2 ProductsEPSS 0.2%CVE-2024-2372MEDIUMOpen Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing AttacksEPSS 0.2%CVE-2024-4867MEDIUMCross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information RetrievalEPSS 0.2%CVE-2026-0637MEDIUMHeader Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log ForgeryEPSS 0.2%CVE-2025-10853MEDIUMReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingEPSS 0.2%CVE-2025-13173MEDIUMImproper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationEPSS 0.2%CVE-2024-5563MEDIUMIncomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force AttacksEPSS 0.2%CVE-2024-8995MEDIUMAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessEPSS 0.2%CVE-2025-4760MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherEPSS 0.2%CVE-2024-7075MEDIUMReflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 ProductsEPSS 0.2%CVE-2025-8154MEDIUMHTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header ManipulationEPSS 0.2%CVE-2024-0391MEDIUMUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%CVE-2025-7043MEDIUMRefresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource ConsumptionEPSS 0.2%CVE-2025-13647MEDIUMInformation Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File PathsEPSS 0.2%CVE-2024-9517MEDIUMImproper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked AccountsEPSS 0.2%CVE-2025-10149HIGHArbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account TakeoverEPSS 0.2%CVE-2025-12624MEDIUMImproper Token Invalidation in WSO2 Identity Server Allows Access After Account LockEPSS 0.2%