VendorsWSO2open_banking_am2.0.0
Vulnerabilities

WSO2 Open Banking AM 2.0.0

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

16CVEs
CVE-2025-10611
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
Published 2025-10-16 · Analyzed
9.8EPSS 0.008
CVE-2024-6914
Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
Published 2025-05-22 · Analyzed
9.8EPSS 0.007
CVE-2025-9312
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
Published 2025-11-18 · Analyzed
9.8EPSS 0.002
CVE-2025-9804
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Published 2025-10-16 · Analyzed
9.6EPSS 0.006
CVE-2025-10713
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
Published 2025-11-05 · Analyzed
9.1EPSS 0.004
CVE-2025-6670
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
Published 2025-11-18 · Analyzed
8.8EPSS 0.002
CVE-2025-10907
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
Published 2025-11-05 · Analyzed
8.4EPSS 0.006
CVE-2024-6832
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
Published 2026-08-06 · Analyzed
7.5EPSS 0.004
CVE-2025-5717
Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
Published 2025-09-23 · Analyzed
7.2EPSS 0.007
CVE-2025-10853
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
Published 2025-11-05 · Analyzed
6.1EPSS 0.002
CVE-2025-5350
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
Published 2025-10-24 · Analyzed
5.9EPSS 0.006
CVE-2024-7096
Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
Published 2025-05-30 · Modified
5.4EPSS 0.007
CVE-2025-5605
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
Published 2025-10-24 · Analyzed
5.3EPSS 0.009
CVE-2024-8008
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Published 2025-06-02 · Analyzed
5.2EPSS 0.005
CVE-2024-7097
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
Published 2025-05-30 · Analyzed
4.3EPSS 0.007
CVE-2024-3511
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
Published 2025-06-23 · Analyzed
4.3EPSS 0.002