Vulnerabilities in WSO2
131 resultsCVE-2025-8325MEDIUMImproper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized OperationsEPSS 0.2%CVE-2025-10503MEDIUMReflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity ServerEPSS 0.2%CVE-2025-5769MEDIUMReflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI ModificationEPSS 0.2%CVE-2026-19515HIGHOS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command ExecutionEPSS 0.2%CVE-2024-4989MEDIUMOpen Redirection via Callback URL in WSO2 API Manager Allows Phishing AttacksEPSS 0.2%CVE-2026-18800MEDIUMInformation Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive DataEPSS 0.2%CVE-2025-7203MEDIUMSensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of CredentialsEPSS 0.2%CVE-2025-1397MEDIUMImproper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity ProvidersEPSS 0.2%CVE-2024-0392MEDIUMCross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token ValidationEPSS 0.1%CVE-2025-13394MEDIUMCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsEPSS 0.1%CVE-2024-6423MEDIUMSensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information LeakageEPSS 0.1%