Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-2613

SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Wso2 Api Control Plane and 4 more
CVE-2025-14561

Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Wso2 Api Control Plane Wso2 Api Manager Wso2 Carbon Api Management Implementation and 3 more
CVE-2026-3415

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Wso2 Api Control Plane Wso2 Api Manager Wso2 Carbon Api Gateway and 3 more
CVE-2026-3418

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Carbon Api Management Api and 9 more
CVE-2025-8154

HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Traffic Manager and 7 more
CVE-2025-8325

Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, potentially exposing them in WSO2 APIM 3.x versions. A malicious actor with a valid user account on a vulnerable deployment can perform sensitive operations against the Gateway REST API regardless of their actual roles or privileges. This could lead to unintended behavior or misuse, particularly in production environments.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Traffic Manager and 7 more