WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-5430 Write-up: https://abraxaslabs.tech/research/CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 - WSO2 I am @abraxasnull. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py. JWT alg mix-up...

CVE-2023-31664

CVE-2023-31664 CVE-2023-31664 A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 Api Manager below v4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter. PoC: to exploit it only...

CVE-2022-29548

Proof of concept exploit for CVE-2022-29548: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server...

CVE-2026-5430-WSO2

CVE-2026-5430 — WSO2 API Manager JWT Algorithm Bypass Detection PoC — Authorized Security Assessment Use Only Overview CVE-2026-5430 is a critical unauthenticated account takeover vulnerability in WSO2 API Manager and related products. A forged JWT bearing an unsupported signing algorithm e.g...

wso2_cve-2026-5430_lab

WSO2 API Manager 4.5.0 — CVE-2026-5430 Lab, Scanner & Exploit 🇷🇺 Русский · 🇬🇧 English Русский Инструменты для работы с CVE-2026-5430: уязвимая лаборатория в Docker, многопоточный сканер и интерактивный REST shell. Файл| Назначение ---|--- wso2apilab.sh| Разворачивает уязвимый WSO2 API Manager 4.5.0...

CVE-2026-4052

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

EUVD-2026-115721

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint...

CVE-2026-4052

CVE-2026-4052 affects WSO2 API Manager (APIM 4.x) when the WSO2 Identity Server is configured as a Resident Key Manager with database sharing . The vulnerability allows a self-registered user to gain unauthorized access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO...

PT-2026-136041

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 4.1.0 through 4.6.0 Description A privilege escalation issue exists where a self-registered user can gain unauthorized access to the System REST APIs. This occurs in deployments where WSO2 Identity Server is configure...

WSO2 API Manager cross-site scripting vulnerability

Cross-site scripting vulnerabilities exist in WSO2 API Manager versions prior to 3.2.0.449, versions prior to 3.2.1.68, versions prior to 4.0.0.368, versions prior to 4.1.0.60, versions prior to 4.2.0.7, as well as in WSO2 Carbon API Manager Publisher REST API versions prior to 9.28.140. This...

WSO2 API Manager server request forgery vulnerability

Versions 3.1.0 through 3.1.0.354, 3.2.0 through 3.2.0.458, 3.2.1 through 3.2.1.99, 4.0.0 through 4.0.0.379, 4.1.0 through 4.1.0.265, 4.2.0 through 4.2.0.205, 4.3.0 through 4.3.0.115, and 4.4.0 through 4.4.0.79 of WSO2 API Manager contain a server-side request forgery vulnerability. This...

WSO2 API Manager cross-site scripting vulnerability

Versions 3.2.0 through 3.2.0.480, 3.2.1 through 3.2.1.99, 4.1.0 through 4.1.0.265, 4.2.0 through 4.2.0.205, 4.3.0 through 4.3.0.117, 4.4.0 through 4.4.0.80, 4.5.0 through 4.5.0.65, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.1 of WSO2 API Manager; versions 4.5.0 through 4.5.0.66, 4.6.0 throug...

WSO2 API Manager session mechanism vulnerability

Versions 3.1.0 through 3.1.0.367, 3.2.0 through 3.2.0.475, 3.2.1 through 3.2.1.106, 4.0.0 through 4.0.0.394, 4.1.0 through 4.1.0.267, 4.2.0 through 4.2.0.207, 4.3.0 through 4.3.0.120, 4.4.0 through 4.4.0.83, 4.5.0 through 4.5.0.67, 4.6.0 through 4.6.0.29, and 4.7.0 through 4.7.0.3 contain a sessi...

CVE-2024-4989

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

CVE-2024-4989 Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

CVE-2024-4989

The WSO2 API Manager is vulnerable to an open redirection flaw due to the callback URL parameter failing to validate user-supplied input. Malicious actors can control this parameter to redirect users to arbitrary web pages. This vulnerability can be leveraged in social engineering schemes to perf...

EUVD-2024-55811

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...

CVE-2024-4989 Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering...