Product by WSO2
WSO2 Open Banking AM
26 known vulnerabilities in WSO2 Open Banking AM (WSO2), 1 of them actively exploited (CISA KEV).
Key figures
26
Vulnerabilities
1
Actively exploited (KEV)
1
Used by ransomware
8
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-29464 | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability In CISA KEVRansomwarealso in 7 other products | 9.8 | |
| Critical | CVE-2025-15039 | Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products | 9.4 | |
| Critical | CVE-2025-10611 | Potential Broken Access Control in Multiple WSO2 Products via System REST APIs | 9.8 | |
| Critical | CVE-2024-6914 | WSO2 API Manager: Incorrect Authorization | 9.8 | |
| Critical | CVE-2025-9804 | WSO2 API Manager: Improper Access Control | 9.6 | |
| High | CVE-2025-12737 | WSO2 Open Banking AM: OS Command Injection | 8.4 | |
| High | CVE-2025-10907 | WSO2 API Manager: Unrestricted Upload of File with Dangerous Type | 8.4 | |
| High | CVE-2024-6832 | WSO2 Enterprise Integrator: Protection Mechanism Failure | 7.5 | |
| High | CVE-2025-5717 | Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service | 6.8 | |
| Critical | CVE-2025-9312 | Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products | 9.8 | |
| Critical | CVE-2024-2374 | WSO2 API Manager: Improper Restriction of XML External Entity Reference | 7.5 | |
| Medium | CVE-2025-5350 | SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products | 5.9 | |
| Medium | CVE-2025-5605 | WSO2 Identity Server: Authentication Bypass | 4.3 | |
| High | CVE-2025-6670 | Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services | 8.8 | |
| Critical | CVE-2025-10713 | WSO2 Enterprise Integrator: Improper Restriction of XML External Entity Reference | 6.5 | |
| Medium | CVE-2024-7096 | Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw | 4.2 | |
| Medium | CVE-2025-8591 | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification | 6.1 | |
| Medium | CVE-2024-7097 | WSO2 Open Banking AM: Improper Access Control | 4.3 | |
| Medium | CVE-2024-8008 | WSO2 Enterprise Integrator: Cross-site Scripting | 5.2 | |
| Medium | CVE-2025-13394 | WSO2 Identity Server: Cross-Site Request Forgery (CSRF) | 5.4 | |
| Medium | CVE-2024-1248 | Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation | 4.8 | |
| Medium | CVE-2024-8995 | WSO2 API Manager: Insufficient Session Expiration | 4.9 | |
| Medium | CVE-2026-0637 | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products | 4.4 | |
| Low | CVE-2025-13736 | Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery | 3.7 | |
| Medium | CVE-2025-10853 | WSO2 Open Banking IAM: Cross-site Scripting | 5.2 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31sans-atrisk-mail,