Arbitrary Code Injection

Overview org.apache.synapse:synapse-extensions is an Apache Synapse - Extensions Affected versions of this package are vulnerable to Arbitrary Code Injection due to a lack of controls on the GraalJS and NashornJS Script Mediator engines. An attacker can execute arbitrary code with elevated...

CVE-2025-11093

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access ...

EUVD-2025-37932

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access ...

CVE-2025-11093

An Arbitrary Code Execution vulnerability (CVE-2025-11093) affects multiple WSO2 products due to insufficient restrictions in GraalJS and NashornJS Script Mediator engines. The issue can be triggered by authenticated users with elevated privileges, potentially executing code within the integratio...

CVE-2025-11093 Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access ...

PT-2025-45148

Name of the Vulnerable Software and Affected Versions WSO2 Micro Integrator affected versions not specified WSO2 Enterprise Integrator affected versions not specified WSO2 API Manager affected versions not specified Description An arbitrary code execution issue exists due to insufficient...

WSO2’s various products have security vulnerabilities

WSO2 API Manager and other products are products of WSO2, Inc.WSO2 API Manager is an API lifecycle management solution.WSO2 Enterprise Integrator is an open source hybrid integration platform.WSO2 Micro Integrator is a distributed microservices integration layer.WSO2 Micro Integrator is a...

CVE-2025-11093: Improper Control of Generation of Code

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access ...