Vulnerabilidades en WSO2
126 resultadosCVE-2025-4760MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherEPSS 0.2%CVE-2024-8995MEDIUMAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessEPSS 0.2%CVE-2025-8154MEDIUMHTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header ManipulationEPSS 0.2%CVE-2024-0391MEDIUMUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%CVE-2025-7043MEDIUMRefresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource ConsumptionEPSS 0.2%CVE-2025-10149HIGHArbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account TakeoverEPSS 0.2%CVE-2025-12624MEDIUMImproper Token Invalidation in WSO2 Identity Server Allows Access After Account LockEPSS 0.2%CVE-2025-8325MEDIUMImproper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized OperationsEPSS 0.2%CVE-2025-10503MEDIUMReflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity ServerEPSS 0.2%CVE-2026-19515HIGHOS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command ExecutionEPSS 0.2%CVE-2024-4989MEDIUMOpen Redirection via Callback URL in WSO2 API Manager Allows Phishing AttacksEPSS 0.2%CVE-2026-0637MEDIUMSensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 ProductsEPSS 0.2%CVE-2025-7203MEDIUMSensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of CredentialsEPSS 0.2%CVE-2024-0392MEDIUMCross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token ValidationEPSS 0.1%CVE-2025-13394MEDIUMCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsEPSS 0.1%CVE-2024-6423MEDIUMSensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information LeakageEPSS 0.1%CVE-2024-5617MEDIUMAccount Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force AttacksEPSS —CVE-2026-18800MEDIUMInformation Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive DataEPSS —CVE-2024-12141MEDIUMOpen Redirect via Callback URL Validation in WSO2 Products Allows Phishing AttacksEPSS —CVE-2026-2613HIGHSQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service DisruptionEPSS —