CVE-2023-31664

CVE-2023-31664 CVE-2023-31664 A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 Api Manager below v4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter. PoC: to exploit it only...

CVE-2022-29464

CVE-2022-29464 WSO2 is a leading provider of various SOA solutions, including SOA-related infrastructure, technical frameworks, and related tools, process servers, application servers, etc. Affected Versions 2.2.0 ≤ WSO2 API Manager ≤ 4.0.0 5.2.0 ≤ WSO2 Identity Server ≤ 5.11.0 WSO2 Identity Serv...

WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...

CVE-2022-29548

Proof of concept exploit for CVE-2022-29548: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 - WSO2 I am @abraxasnull. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py. JWT alg mix-up. JWTUtil.verifyTokenSignature throws on non-RSA alg. Pre-patch...

CVE-2026-22777

CVE-2026-22777 — ComfyUI-Manager CRLF Injection - RCE with CVE-2025-67303 Severity: Critical CVSS 9.8 Affected: ComfyUI-Manager Code Execution How It Works ComfyUI-Manager exposes a /api/manager/dbmode endpoint that accepts a value query parameter and writes it directly into config.ini using...

WSO2 - Cross-Site Scripting

WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0,...

CVE-2024-4989

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

CVE-2024-4989

The WSO2 API Manager is vulnerable to an open redirection flaw due to the callback URL parameter failing to validate user-supplied input. Malicious actors can control this parameter to redirect users to arbitrary web pages. This vulnerability can be leveraged in social engineering schemes to perf...

EUVD-2024-55811

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

CVE-2024-4989 Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

PT-2026-120599

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

Exploit for Improper Verification of Cryptographic Signature in Wso2 Api_Control_Plane

WSO2 API Manager 4.5.0 — CVE-2026-5430 Lab, Scanner & Exploit...

Exploit for Improper Verification of Cryptographic Signature in Wso2 Api_Control_Plane

CVE-2026-5430 — WSO2 API Manager JWT Algorithm Bypass Det...

WSO2 CVE-2026-5430 JWT Auth Bypass Detect

Detects CVE-2026-5430 in WSO2 API Manager / Control Plane / Traffic Manager / Universal Gateway: JWTUtil accepts tokens whose alg header is outside the supported RS256/384/512 set. Probes admin APIs with an alg:none X-JWT-Assertion. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WSO2...

Exploit for Improper Verification of Cryptographic Signature in Wso2 Api_Control_Plane

abraxaslabs.tech · github.com/abraxas ·&...

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 CVSS score: 9.8/10.0, is a case of improper verification of a cryptographic signature that could result in account takeove...

CVE-2025-6508 User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...

CVE-2025-6508

The CVE-2025-6508 entry concerns the Swagger UI Try-out console in the WSO2 API Manager’s API Publisher docs. A misbehavior allows loading an external Swagger API definition URL, which overwrites existing API definitions in the Publisher portal. This deception can lead users to interact with over...