Product by WSO2

    WSO2 Identity Server

    83 known vulnerabilities in WSO2 Identity Server (WSO2), 1 of them actively exploited (CISA KEV).

    Key figures

    83

    Vulnerabilities

    1

    Actively exploited (KEV)

    1

    Used by ransomware

    9

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WSO2 Identity Server (WSO2)
    CriticalCVE-2022-29464

    WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

    In CISA KEVRansomwarealso in 7 other products

    		9.8
    CriticalCVE-2021-42646

    WSO2 API Manager: XML External Entity (XXE)

    also in 2 other products

    		9.1
    MediumCVE-2020-17453

    WSO2 Identity Server as Key Manager: Cross-Site Scripting (XSS)

    also in 7 other products

    		6.1
    HighCVE-2016-4312

    WSO2 Identity Server: XML External Entity (XXE)

    		7.5
    HighCVE-2016-4311

    WSO2 Identity Server: Cross-Site Request Forgery (CSRF)

    		8.8
    MediumCVE-2018-8716

    WSO2 Identity Server: Cross-Site Scripting (XSS)

    		5.4
    MediumCVE-2022-29548

    WSO2 API Manager: Cross-Site Scripting (XSS)

    also in 8 other products

    		4.6
    CriticalCVE-2025-15039

    Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

    also in 18 other products

    		9.4
    MediumCVE-2017-14651

    WSO2 Data Analytics Server: Cross-Site Scripting (XSS)

    also in 5 other products

    		4.8
    CriticalCVE-2025-10611

    Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

    also in 17 other products

    		9.8
    CriticalCVE-2024-6914

    WSO2 API Manager: Incorrect Authorization

    also in 11 other products

    		9.8
    HighCVE-2025-12107

    WSO2 Identity Server: Code Injection

    		8.4
    HighCVE-2020-24705

    WSO2 API Manager: security vulnerability

    also in 5 other products

    		8.8
    HighCVE-2020-24703

    WSO2 Identity Server: security vulnerability

    also in 8 other products

    		8.8
    CriticalCVE-2025-9804

    WSO2 API Manager: Improper Access Control

    also in 24 other products

    		9.6
    HighCVE-2020-12719

    WSO2 API Manager: XML External Entity (XXE)

    also in 6 other products

    		8.7
    HighCVE-2025-12737

    WSO2 Open Banking AM: OS Command Injection

    also in 15 other products

    		8.4
    HighCVE-2025-3125

    WSO2 Identity Server: Unrestricted Upload of File with Dangerous Type

    also in 15 other products

    		6.7
    HighCVE-2025-10907

    WSO2 API Manager: Unrestricted Upload of File with Dangerous Type

    also in 19 other products

    		8.4
    MediumCVE-2019-20436

    WSO2 Identity Server: Cross-Site Scripting (XSS)

    also in 1 other product

    		6.1
    HighCVE-2024-6832

    WSO2 Enterprise Integrator: Protection Mechanism Failure

    also in 17 other products

    		7.5
    MediumCVE-2019-20437

    WSO2 Identity Server: Cross-Site Scripting (XSS)

    also in 1 other product

    		6.1
    HighCVE-2025-10470

    WSO2 Identity Server: Uncontrolled Resource Consumption

    also in 2 other products

    		8.6
    CriticalCVE-2025-9312

    Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

    also in 17 other products

    		9.8
    CriticalCVE-2024-2374

    WSO2 API Manager: Improper Restriction of XML External Entity Reference

    also in 9 other products

    		7.5

    All vulnerabilities in search

    News

    All products by WSO2