CVE-2025-10713

CVE-2025-10713 is an XML External Entity (XXE) vulnerability affecting multiple WSO2 products due to improper XML parser configuration. The issue allows an attacker to read sensitive server files or cause DoS via unrestrained external entities. Documented impact: remote, unauthenticated access wi...

CVE-2025-3125

CVE-2025-3125 describes an arbitrary file upload vulnerability in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with administrative privileges can upload a malicious file to a user-controlled location on the serv...

CVE-2025-5770

WSO2: CVE-2025-5770 is a reflected XSS in authentication endpoints across multiple WSO2 products (e.g., Identity Server, API Manager, API Control Plane) caused by insufficient output encoding. The vulnerability allows a malicious actor to inject JavaScript that is reflected in responses, enabling...

CVE-2025-5605

CVE-2025-5605 describes an authentication bypass in the Management Console of multiple WSO2 products. A malicious actor who has console access can manipulate the request URI to bypass authentication and access restricted resources, resulting in partial information disclosure. The known exposure i...

CVE-2025-10611

CVE-2025-10611 describes an insufficient access-control implementation across multiple WSO2 Products, allowing bypass of authentication and authorization checks on certain REST APIs. This could let an unauthenticated actor invoke APIs and perform unauthenticated/unauthorized administrative operat...

CVE-2025-10907

CVE-2025-10907 describes an arbitrary file upload vulnerability in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a crafted file to a user-controlled location within the ...

CVE-2025-4760

CVE-2025-4760 is an authenticated stored XSS vulnerability in multiple WSO2 products, arising from improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript that...

CVE-2025-5350

CVE-2025-5350 affects WSO2 products via the deprecated Try-It feature. The vulnerability is caused by insufficient validation of user-supplied URLs, enabling SSRF and reflected XSS in the admin context when an administrator is tricked into visiting a crafted link. The SSRF could reach internal se...

CVE-2025-9312

CVE-2025-9312 relates to a missing authentication enforcement in WSO2 products’ mTLS implementation used by System REST APIs and SOAP services. The root cause is improper validation of client certificate–based authentication under certain default configurations, allowing unauthenticated requests ...

CVE-2025-13590

The CVE-2025-13590 entry describes an authenticated arbitrary file upload via a System REST API that requires administrator permissions. The vulnerability allows an admin-restricted user to upload a file to a user-controlled location, with the potential consequence of remote code execution. CVSS ...

CVE-2025-9804

The CVE-2025-9804 entry concerns multiple WSO2 products (e.g., API Manager family) with an improper access-control flaw due to insufficient permission enforcement in internal SOAP Admin Services and System REST APIs. The root cause is limited access-control checks on internal interfaces, allowing...

CVE-2025-11093

An Arbitrary Code Execution vulnerability (CVE-2025-11093) affects multiple WSO2 products due to insufficient restrictions in GraalJS and NashornJS Script Mediator engines. The issue can be triggered by authenticated users with elevated privileges, potentially executing code within the integratio...

CVE-2025-8325

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2025-8325; current sources describe an RBAC bypass affecting Gateway and Internal Service APIs in WSO2 products, but no concrete technical specifics are provided here.

CVE-2025-9152

CVE-2025-9152 affects WSO2 API Manager (and API Control Plane) via the keymanager-operations Dynamic Client Registration endpoint. The root cause is missing authentication and authorization checks, causing improper privilege management. An attacker could generate access tokens with elevated privi...

CVE-2025-5717

CVE-2025-5717 describes an authenticated remote code execution in multiple WSO2 products caused by improper input validation in the Event Processor Admin Service. An attacker with administrative access to SOAP admin services can deploy a Siddhi execution plan containing malicious Java code, enabl...

CVE-2025-6670

Summary: CVE-2025-6670 describes a CSRF vulnerability in multiple WSO2 products due to using HTTP GET for state-changing admin service operations in the Carbon console event processor. Despite SameSite=Lax mitigation, the cookie attribute is ineffective for cross-origin top-level navigations, all...

CVE-2025-10853

Summary: CVE-2025-10853 is a reflected XSS vulnerability in the management console of multiple WSO2 products caused by improper output encoding. The issue allows a malicious actor to tamper with specific parameters to inject arbitrary JavaScript into responses, potentially leading to UI manipulat...

CVE-2025-8154

CVE-2025-8154 describes an HTTP header injection vulnerability in the Webhook API invocations causing headers to be injected/overwritten in responses. Affected products include multiple WSO2 offerings (e.g., API Manager, Universal Gateway, Traffic Manager, API Control Plane, Carbon API Gateway/Ma...