WSO2 WSO2 API Control Plane
42 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-13173 | 4.5.0 – < 4.5.0.47 ; 4.6.0 – < 4.6.0.13 | Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-7203 | 4.5.0 – < 4.5.0.47 ; 4.6.0 – < 4.6.0.15 | Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials | MEDIUM 4.9 | 0.2 % | ||
| CVE-2025-7043 | 4.5.0 – < 4.5.0.15 | Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-6623 | 4.5.0 – < 4.5.0.12 | Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-5802 | 4.5.0 – < 4.5.0.56 ; 4.6.0 – < 4.6.0.18 | Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-4103 | 4.5.0 – < 4.5.0.55 ; 4.6.0 – < 4.6.0.19 | Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-3096 | 4.5.0 – < 4.5.0.54 ; 4.6.0 – < 4.6.0.18 | Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft | MEDIUM 4.7 | 0.3 % | ||
| CVE-2025-12737 | 4.5.0 – < 4.5.0.36 ; 4.6.0 – < 4.6.0.1 | Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution | HIGH 8.4 | 0.4 % | ||
| CVE-2026-3416 | 4.5.0 – < 4.5.0.53 | Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads | HIGH 7.5 | 0.4 % | ||
| CVE-2026-3418 | 4.5.0 – < 4.5.0.53 ; 4.6.0 – < 4.6.0.17 | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution | CRITICAL 9.1 | 0.8 % | ||
| CVE-2026-3415 | 4.5.0 – < 4.5.0.54 ; 4.6.0 – < 4.6.0.17 | XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service | HIGH 8.7 | 0.5 % | ||
| CVE-2025-14561 | 4.5.0 – < 4.5.0.42 ; 4.6.0 – < 4.6.0.7 | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations | CRITICAL 9.0 | 0.4 % | ||
| CVE-2026-5430 | 4.5.0 – < 4.5.0.58 ; 4.6.0 – < 4.6.0.22 | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | CRITICAL 10.0 | 22 % | KEV | |
| CVE-2026-1728 | 4.5.0 – < 4.5.0.49 ; 4.6.0 – < 4.6.0.13 | Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover | CRITICAL 9.8 | 0.5 % | ||
| CVE-2025-15039 | | Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products | CRITICAL 9.4 | 0.7 % | ||
| CVE-2026-0637 | 4.5.0 – < 4.5.0.50 ; 4.6.0 – < 4.6.0.14 | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products | MEDIUM 4.4 | 0.2 % | ||
| CVE-2025-13394 | | Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions | MEDIUM 5.4 | 0.1 % | ||
| CVE-2024-10302 | 4.5.0 – < 4.5.0.10 | Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure | MEDIUM 5.8 | 0.3 % | ||
| CVE-2024-6832 | 4.5.0 – < 4.5.0.40 ; 4.6.0 – < 4.6.0.4 ; 4.6.0 – < 4.6.0.5 | Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks | HIGH 7.5 | 0.4 % | ||
| CVE-2024-8995 | 4.5.0 – < 4.5.0.56 ; 4.6.0 – < 4.6.0.20 | Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access | MEDIUM 4.9 | 0.2 % | ||
| CVE-2026-2445 | 4.5.0 – < 4.5.0.56 ; 4.6.0 – < 4.6.0.20 | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-4249 | 4.5.0 – < 4.5.0.55 ; 4.6.0 – < 4.6.0.19 ; 4.7.0 – < 4.7.0.2 | Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption | HIGH 8.6 | 0.6 % | ||
| CVE-2025-8591 | 4.5.0 – < 4.5.0.44 ; 4.6.0 – < 4.6.0.8 | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-8325 | 4.5.0 – < 4.5.0.18 | Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations | HIGH 8.8 | 0.2 % | ||
| CVE-2025-8154 | 4.5.0 – < 4.5.0.21 | HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation | HIGH 7.5 | 0.2 % | ||
| CVE-2025-13590 | 4.5.0 – < 4.5.0.39 ; 4.6.0 – < 4.6.0.3 | Authenticated arbitrary file upload via a System REST API requiring administrator permission. | CRITICAL 9.1 | 0.8 % | ||
| CVE-2025-9312 | 4.5.0 – < 4.5.0.22 | Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products | CRITICAL 9.8 | 0.3 % | ||
| CVE-2025-6670 | 4.5.0 – < 4.5.0.36 ; 4.6.0 – < 4.6.0.1 | Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services | HIGH 8.8 | 0.2 % | ||
| CVE-2025-10853 | | Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-5770 | 4.5.0 – < 4.5.0.11 | Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-11093 | 4.5.0 – < 4.5.0.29 | Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) | HIGH 8.4 | 0.5 % | ||
| CVE-2025-10907 | 4.5.0 – < 4.5.0.29 | Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution | HIGH 8.4 | 0.6 % | ||
| CVE-2025-10713 | 4.5.0 – < 4.5.0.27 | XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration | CRITICAL 9.1 | 0.5 % | ||
| CVE-2025-3125 | | Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution | HIGH 7.2 | 0.9 % | ||
| CVE-2025-5605 | | Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure | MEDIUM 5.3 | 0.9 % | ||
| CVE-2025-5350 | | SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products | MEDIUM 5.9 | 0.6 % | ||
| CVE-2025-9152 | 4.5.0 – < 4.5.0.20 | Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint | CRITICAL 9.8 | 0.7 % | ||
| CVE-2025-9804 | | Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs | CRITICAL 9.6 | 0.6 % | ||
| CVE-2025-10611 | 4.5.0 – < 4.5.0.29 | Potential Broken Access Control in Multiple WSO2 Products via System REST APIs | CRITICAL 9.8 | 0.8 % | ||
| CVE-2025-5717 | 4.5.0 – < 4.5.0.6 | Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service | HIGH 7.2 | 0.7 % | ||
| CVE-2025-4760 | 4.5.0 – < 4.5.0.8 | Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher | MEDIUM 4.8 | 0.2 % | ||
| CVE-2024-8008 | | Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation | MEDIUM 5.2 | 0.5 % |