Product by WSO2

    Wso2 Open Banking Iam

    45 known vulnerabilities in Wso2 Open Banking Iam (WSO2), 0 of them actively exploited (CISA KEV).

    Key figures

    45

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Wso2 Open Banking Iam (WSO2)
    CriticalCVE-2025-15039

    Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

    also in 18 other products

    		9.4
    CriticalCVE-2025-10611

    Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

    also in 17 other products

    		9.8
    CriticalCVE-2024-4457

    WSO2 Enterprise Integrator: OS Command Injection

    also in 6 other products

    		9.1
    CriticalCVE-2024-6914

    WSO2 API Manager: Incorrect Authorization

    also in 11 other products

    		9.8
    CriticalCVE-2025-9804

    WSO2 API Manager: Improper Access Control

    also in 24 other products

    		9.6
    HighCVE-2025-12737

    WSO2 Open Banking AM: OS Command Injection

    also in 15 other products

    		8.4
    HighCVE-2025-14260

    WSO2 API Manager: Server-Side Request Forgery (SSRF)

    also in 4 other products

    		8.3
    HighCVE-2025-3125

    WSO2 Identity Server: Unrestricted Upload of File with Dangerous Type

    also in 15 other products

    		6.7
    HighCVE-2025-10907

    WSO2 API Manager: Unrestricted Upload of File with Dangerous Type

    also in 19 other products

    		8.4
    HighCVE-2025-10149

    Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

    also in 2 other products

    		8.2
    HighCVE-2024-6832

    WSO2 Enterprise Integrator: Protection Mechanism Failure

    also in 17 other products

    		7.5
    HighCVE-2025-11093

    WSO2 Micro Integrator: Code Injection

    also in 14 other products

    		8.4
    CriticalCVE-2025-9312

    Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

    also in 17 other products

    		9.8
    MediumCVE-2025-13173

    WSO2 API Control Plane: Insufficient Session Expiration

    also in 8 other products

    		6.5
    MediumCVE-2024-5139

    WSO2 Enterprise Integrator: Cross-site Scripting

    also in 5 other products

    		6.1
    CriticalCVE-2024-2374

    WSO2 API Manager: Improper Restriction of XML External Entity Reference

    also in 9 other products

    		7.5
    HighCVE-2025-1862

    WSO2 Enterprise Integrator: Unrestricted Upload of File with Dangerous Type

    also in 7 other products

    		6.7
    MediumCVE-2024-7478

    WSO2 API Manager: Observable Response Discrepancy

    also in 5 other products

    		5.8
    MediumCVE-2025-5350

    SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

    also in 18 other products

    		5.9
    MediumCVE-2025-5605

    WSO2 Identity Server: Authentication Bypass

    also in 18 other products

    		4.3
    MediumCVE-2025-5802

    WSO2 API Manager: Observable Discrepancy

    also in 8 other products

    		5.3
    CriticalCVE-2025-10713

    WSO2 Enterprise Integrator: Improper Restriction of XML External Entity Reference

    also in 16 other products

    		6.5
    MediumCVE-2024-2323

    WSO2 Enterprise Integrator: Improper Restriction of Excessive Authentication Attempts

    also in 6 other products

    		4.8
    MediumCVE-2024-10302

    WSO2 API Control Plane: Improper Input Validation

    also in 13 other products

    		5.8
    MediumCVE-2024-7096

    Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw

    also in 12 other products

    		4.2

    All vulnerabilities in search

    News

    All products by WSO2