CVE-2022-29464

CVE-2022-29464 WSO2 は、SOA 関連のインフラストラクチャ、技術フレームワーク、関連ツール、プロセスサーバー、アプリケーションサーバーなどを含む、さまざまな SOA ソリューションを提供するリーディングカンパニーです。 影響範囲 2.2.0 ≤ WSO2 API Manager ≤ 4.0.0 5.2.0 ≤ WSO2 Identity Server ≤ 5.11.0 WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, 5.6.0 5.3.0 ≤ WSO2 Identity Server as Key Manager...

CVE-2022-29548

CVE-2022-29548 の概念実証エクスプロイト: 複数の WSO2 製品の Management Console に反射型 XSS の問題が存在します。影響を受ける製品は以下のとおりです: API Manager 2.2.0、2.5.0、2.6.0、3.0.0、3.1.0、3.2.0、4.0.0、API Manager Analytics 2.2.0、2.5.0、2.6.0、API Microgateway 2.2.0、Data Analytics Server 3.2.0、Enterprise Integrator 6.2.0、6.3.0、6.4.0、6.5.0、6.6.0、I...

CVE-2023-31664

CVE-2023-31664 CVE-2023-31664 WSO2 Api Manager v4.2.0未満の/authenticationendpoint/login.doにおけるリフレクション型クロスサイトスクリプティング（XSS）の脆弱性により、攻撃者がtenantDomainパラメータに注入された細工されたペイロードを介して任意のWebスクリプトまたはHTMLを実行できるようになります。 PoC: これを悪用するには、tenantDomainパラメータの値をsuper.carbonからに変更するだけでよい。 例:...

WSO2RCE

WSO2RCE CVE-2022-29464 は、 WSO2 API Manager や WSO2 Open Banking などの一部の WSO2 製品に影響を与え、任意のファイルアップロードおよびリモートコード実行を許可します。 影響を受ける製品: WSO2 API Manager 2.2.0 から 4.0.0 WSO2 Identity Server 5.2.0 から 5.11.0 WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, 5.6.0 WSO2 Identity Server as Key Manager 5.3.0 か...

CVE-2026-22777

CVE-2026-22777 — ComfyUI-Manager CRLFインジェクション - RCE CVE-2025-67303との連鎖 深刻度: クリティカル CVSS 9.8 影響を受けるバージョン: ComfyUI-Manager コード実行 仕組み ComfyUI-Managerは /api/manager/dbmode エンドポイントを公開しており、value クエリパラメータを受け取り、Pythonの configparser を使ってそれを直接 config.ini に書き込みます。 この脆弱性は ベアキャリッジリターンインジェクション \r / %0D です:...

WSO2 - Cross-Site Scripting

WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0,...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 — WSO2 JWT 認証メカニズムが、明示的に設定またはサポートされているもの以外のアルゴリズムで署名されたトークンを受け入れます。これにより、攻撃者はサポートされていないアルゴリズムで JWT を偽造でき、それが誤って検証されることで、不正アクセスにつながります。 | ---|--- CVE| CVE-2026-5430 · CVE.org CWE| CWE-347 CVSS...

Exploit for Improper Verification of Cryptographic Signature in Wso2 Api_Control_Plane

abraxaslabs.tech · github.com/abraxas ·&...

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...

Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

A critical security flaw in WSO2 API Manager has come under active exploitation in the wild, according to findings from watchTowr. The vulnerability, tracked as CVE-2026-5430 CVSS score: 9.8/10.0, is a case of improper verification of a cryptographic signature that could result in account takeove...

CVE-2025-6508 User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...

CVE-2025-6508

The CVE-2025-6508 entry concerns the Swagger UI Try-out console in the WSO2 API Manager’s API Publisher docs. A misbehavior allows loading an external Swagger API definition URL, which overwrites existing API definitions in the Publisher portal. This deception can lead users to interact with over...

CVE-2026-18059: Exposure of Sensitive Information to an Unauthorized Actor

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

CVE-2026-2053

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated...

CVE-2026-2053

The CVE-2026-2053 entry concerns the WSO2 API Manager: the message flow component mishandles WS-Addressing headers by not adequately validating user-controlled input, allowing an attacker to manipulate headers to set arbitrary destinations for server-initiated requests. This results in unauthenti...

CVE-2026-2053

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated...

CVE-2026-2053 Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated...

CVE-2026-2053: Server-Side Request Forgery (SSRF)

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated...

CVE-2025-8325

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2025-8325; current sources describe an RBAC bypass affecting Gateway and Internal Service APIs in WSO2 products, but no concrete technical specifics are provided here.

PT-2026-53824

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 4.1.0 through 4.6.0 WSO2 API Control Plane versions 4.5.0 through 4.6.0 WSO2 Traffic Manager versions 4.5.0 through 4.6.0 WSO2 Universal Gateway versions 4.5.0 through 4.6.0 Description The JWT authentication mechanis...