CVE-2025-9804

The CVE-2025-9804 entry concerns multiple WSO2 products (e.g., API Manager family) with an improper access-control flaw due to insufficient permission enforcement in internal SOAP Admin Services and System REST APIs. The root cause is limited access-control checks on internal interfaces, allowing...

CVE-2025-9955

CVE-2025-9955: An improper access control vulnerability in WSO2 Enterprise Integrator arises from insufficient permission restrictions on internal SOAP admin services governing system logs and user-store configuration. A low-privileged user can view log data and user-store configuration details n...