WSO2 WSO2 Traffic Manager
35 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-13173 | 4.5.0 – < 4.5.0.45 ; 4.6.0 – < 4.6.0.11 | Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-7203 | 4.5.0 – < 4.5.0.45 ; 4.6.0 – < 4.6.0.14 | Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials | MEDIUM 4.9 | 0.2 % | ||
| CVE-2025-6623 | 4.5.0 – < 4.5.0.11 | Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-5802 | 4.5.0 – < 4.5.0.54 ; 4.6.0 – < 4.6.0.17 | Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-12737 | 4.5.0 – < 4.5.0.34 ; 4.6.0 – < 4.6.0.1 | Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution | HIGH 8.4 | 0.4 % | ||
| CVE-2026-3418 | 4.5.0 – < 4.5.0.51 ; 4.6.0 – < 4.6.0.16 | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution | CRITICAL 9.1 | 0.8 % | ||
| CVE-2026-3415 | 4.5.0 – < 4.5.0.52 ; 4.6.0 – < 4.6.0.16 | XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service | HIGH 8.7 | 0.5 % | ||
| CVE-2025-14561 | 4.5.0 – < 4.5.0.40 ; 4.6.0 – < 4.6.0.6 | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations | CRITICAL 9.0 | 0.4 % | ||
| CVE-2026-5430 | 4.5.0 – < 4.5.0.56 ; 4.6.0 – < 4.6.0.21 | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | CRITICAL 10.0 | 22 % | KEV | |
| CVE-2026-1728 | 4.5.0 – < 4.5.0.47 ; 4.6.0 – < 4.6.0.12 | Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover | CRITICAL 9.8 | 0.5 % | ||
| CVE-2025-15039 | 4.5.0 – < 4.5.0.43 ; 4.6.0 – < 4.6.0.8 | Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products | CRITICAL 9.4 | 0.7 % | ||
| CVE-2026-0637 | 4.5.0 – < 4.5.0.48 ; 4.6.0 – < 4.6.0.13 | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products | MEDIUM 4.4 | 0.2 % | ||
| CVE-2025-13394 | | Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions | MEDIUM 5.4 | 0.1 % | ||
| CVE-2024-10302 | 4.5.0 – < 4.5.0.9 | Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure | MEDIUM 5.8 | 0.3 % | ||
| CVE-2024-6832 | 4.5.0 – < 4.5.0.38 ; 4.6.0 – < 4.6.0.4 ; 4.6.0 – < 4.6.0.5 | Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks | HIGH 7.5 | 0.4 % | ||
| CVE-2024-8995 | 4.5.0 – < 4.5.0.54 ; 4.6.0 – < 4.6.0.19 | Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access | MEDIUM 4.9 | 0.2 % | ||
| CVE-2026-4249 | 4.5.0 – < 4.5.0.53 ; 4.6.0 – < 4.6.0.18 ; 4.7.0 – < 4.7.0.2 | Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption | HIGH 8.6 | 0.6 % | ||
| CVE-2025-8591 | 4.5.0 – < 4.5.0.42 ; 4.6.0 – < 4.6.0.7 | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-8325 | 4.5.0 – < 4.5.0.17 | Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations | HIGH 8.8 | 0.2 % | ||
| CVE-2025-8154 | 4.5.0 – < 4.5.0.19 | HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation | HIGH 7.5 | 0.2 % | ||
| CVE-2025-13590 | 4.5.0 – < 4.5.0.37 ; 4.6.0 – < 4.6.0.3 | Authenticated arbitrary file upload via a System REST API requiring administrator permission. | CRITICAL 9.1 | 0.8 % | ||
| CVE-2025-9312 | 4.5.0 – < 4.5.0.20 | Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products | CRITICAL 9.8 | 0.3 % | ||
| CVE-2025-6670 | 4.5.0 – < 4.5.0.34 ; 4.6.0 – < 4.6.0.1 | Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services | HIGH 8.8 | 0.2 % | ||
| CVE-2025-10853 | | Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-11093 | | Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) | HIGH 8.4 | 0.5 % | ||
| CVE-2025-10907 | | Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution | HIGH 8.4 | 0.6 % | ||
| CVE-2025-10713 | 4.5.0 – < 4.5.0.25 | XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration | CRITICAL 9.1 | 0.5 % | ||
| CVE-2025-3125 | | Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution | HIGH 7.2 | 0.9 % | ||
| CVE-2025-5605 | 4.5.0 – < 4.5.0.10 | Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure | MEDIUM 5.3 | 0.9 % | ||
| CVE-2025-5350 | 4.5.0 – < 4.5.0.7 | SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products | MEDIUM 5.9 | 0.6 % | ||
| CVE-2025-9804 | | Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs | CRITICAL 9.6 | 0.6 % | ||
| CVE-2025-10611 | | Potential Broken Access Control in Multiple WSO2 Products via System REST APIs | CRITICAL 9.8 | 0.8 % | ||
| CVE-2025-5717 | 4.5.0 – < 4.5.0.6 | Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service | HIGH 7.2 | 0.7 % | ||
| CVE-2025-4760 | 4.5.0 – < 4.5.0.7 | Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher | MEDIUM 4.8 | 0.2 % | ||
| CVE-2024-8008 | | Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation | MEDIUM 5.2 | 0.5 % |