VendorsWSO2api_control_plane4.5.0
Vulnerabilities

WSO2 API Control Plane 4.5.0

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

17CVEs
CVE-2025-10611
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
Published 2025-10-16 · Analyzed
9.8EPSS 0.008
CVE-2025-9152
Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
Published 2025-10-16 · Analyzed
9.8EPSS 0.007
CVE-2025-9312
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
Published 2025-11-18 · Analyzed
9.8EPSS 0.002
CVE-2025-9804
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Published 2025-10-16 · Analyzed
9.6EPSS 0.006
CVE-2025-13590
Authenticated arbitrary file upload via a System REST API requiring administrator permission.
Published 2026-02-19 · Modified
9.1EPSS 0.007
CVE-2025-10713
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
Published 2025-11-05 · Analyzed
9.1EPSS 0.004
CVE-2025-6670
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
Published 2025-11-18 · Analyzed
8.8EPSS 0.002
CVE-2025-10907
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
Published 2025-11-05 · Analyzed
8.4EPSS 0.006
CVE-2024-6832
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
Published 2026-08-06 · Analyzed
7.5EPSS 0.004
CVE-2025-3125
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
Published 2025-11-05 · Analyzed
7.2EPSS 0.008
CVE-2025-5717
Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
Published 2025-09-23 · Analyzed
7.2EPSS 0.007
CVE-2025-5770
Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
Published 2025-11-05 · Analyzed
6.1EPSS 0.002
CVE-2025-10853
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
Published 2025-11-05 · Analyzed
6.1EPSS 0.002
CVE-2025-5350
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
Published 2025-10-24 · Analyzed
5.9EPSS 0.006
CVE-2024-10302
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
Published 2026-08-06 · Undergoing Analysis
5.8EPSS 0.003
CVE-2025-5605
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
Published 2025-10-24 · Analyzed
5.3EPSS 0.009
CVE-2025-4760
Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher
Published 2025-09-23 · Analyzed
4.8EPSS 0.002