Product by WSO2

    WSO2 Open Banking IAM

    33 known vulnerabilities in WSO2 Open Banking IAM (WSO2), 1 of them actively exploited (CISA KEV).

    Key figures

    33

    Vulnerabilities

    1

    Actively exploited (KEV)

    1

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WSO2 Open Banking IAM (WSO2)
    CriticalCVE-2022-29464

    WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

    In CISA KEVRansomwarealso in 7 other products

    		9.8
    CriticalCVE-2025-15039

    Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

    also in 18 other products

    		9.4
    CriticalCVE-2025-10611

    Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

    also in 17 other products

    		9.8
    CriticalCVE-2024-6914

    WSO2 API Manager: Incorrect Authorization

    also in 11 other products

    		9.8
    CriticalCVE-2025-9804

    WSO2 API Manager: Improper Access Control

    also in 24 other products

    		9.6
    HighCVE-2025-12737

    WSO2 Open Banking AM: OS Command Injection

    also in 15 other products

    		8.4
    HighCVE-2025-3125

    WSO2 Identity Server: Unrestricted Upload of File with Dangerous Type

    also in 15 other products

    		6.7
    HighCVE-2025-10907

    WSO2 API Manager: Unrestricted Upload of File with Dangerous Type

    also in 19 other products

    		8.4
    HighCVE-2024-6832

    WSO2 Enterprise Integrator: Protection Mechanism Failure

    also in 17 other products

    		7.5
    CriticalCVE-2025-9312

    Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

    also in 17 other products

    		9.8
    CriticalCVE-2024-2374

    WSO2 API Manager: Improper Restriction of XML External Entity Reference

    also in 9 other products

    		7.5
    HighCVE-2025-1862

    WSO2 Enterprise Integrator: Unrestricted Upload of File with Dangerous Type

    also in 7 other products

    		6.7
    MediumCVE-2025-5350

    SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

    also in 18 other products

    		5.9
    MediumCVE-2025-5605

    WSO2 Identity Server: Authentication Bypass

    also in 18 other products

    		4.3
    HighCVE-2025-6670

    Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

    also in 16 other products

    		8.8
    CriticalCVE-2025-10713

    WSO2 Enterprise Integrator: Improper Restriction of XML External Entity Reference

    also in 16 other products

    		6.5
    MediumCVE-2024-10302

    WSO2 API Control Plane: Improper Input Validation

    also in 13 other products

    		5.8
    MediumCVE-2024-7096

    Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw

    also in 12 other products

    		4.2
    MediumCVE-2025-8591

    Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

    also in 15 other products

    		6.1
    MediumCVE-2024-7097

    WSO2 Open Banking AM: Improper Access Control

    also in 12 other products

    		4.3
    MediumCVE-2024-8008

    WSO2 Enterprise Integrator: Cross-site Scripting

    also in 15 other products

    		5.2
    MediumCVE-2025-13394

    WSO2 Identity Server: Cross-Site Request Forgery (CSRF)

    also in 18 other products

    		5.4
    MediumCVE-2024-1248

    Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

    also in 9 other products

    		4.8
    MediumCVE-2024-8995

    WSO2 API Manager: Insufficient Session Expiration

    also in 16 other products

    		4.9
    MediumCVE-2025-0663

    WSO2 Open Banking IAM: security vulnerability

    also in 5 other products

    		6.8

    All vulnerabilities in search

    News

    All products by WSO2