WSO2 WSO2 Enterprise Integrator
27 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-5139 | 6.6.0 – < 6.6.0.204 | Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection | MEDIUM 6.1 | 0.2 % | ||
| CVE-2024-2323 | 6.6.0 – < 6.6.0.204 | Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery | MEDIUM 4.8 | 0.2 % | ||
| CVE-2024-4412 | 6.6.0 – < 6.6.0.205 | Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations | LOW 2.7 | 0.4 % | ||
| CVE-2024-4457 | 6.6.0 – < 6.6.0.204 | Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-12317 | 6.6.0 – < 6.6.0.228 | Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges | MEDIUM 5.0 | 0.3 % | ||
| CVE-2024-6541 | 6.6.0 – < 6.6.0.205 | Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products | MEDIUM 6.8 | 0.3 % | ||
| CVE-2025-13394 | | Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions | MEDIUM 5.4 | 0.1 % | ||
| CVE-2024-6832 | 6.6.0 – < 6.6.0.229 | Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks | HIGH 7.5 | 0.4 % | ||
| CVE-2025-6670 | | Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services | HIGH 8.8 | 0.2 % | ||
| CVE-2025-10853 | | Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-11093 | 6.6.0 – < 6.6.0.224 | Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) | HIGH 8.4 | 0.5 % | ||
| CVE-2025-10907 | | Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution | HIGH 8.4 | 0.6 % | ||
| CVE-2025-10713 | 6.6.0 – < 6.6.0.223 | XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration | CRITICAL 9.1 | 0.5 % | ||
| CVE-2025-3125 | 6.6.0 – < 6.6.0.217 | Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution | HIGH 7.2 | 0.9 % | ||
| CVE-2025-5605 | 6.6.0 – < 6.6.0.217 | Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure | MEDIUM 5.3 | 0.9 % | ||
| CVE-2025-5350 | 6.6.0 – < 6.6.0.218 | SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products | MEDIUM 5.9 | 0.6 % | ||
| CVE-2025-9804 | | Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs | CRITICAL 9.6 | 0.6 % | ||
| CVE-2025-9955 | 6.0.0 – < 6.0.0.22 ; 6.1.0 – < 6.1.0.39 ; 6.1.1 – < 6.1.1.43 ; … | Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration | MEDIUM 5.7 | 0.2 % | ||
| CVE-2025-1862 | 6.6.0 – < 6.6.0.215 | Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution | HIGH 7.2 | 0.5 % | ||
| CVE-2024-3511 | 6.6.0 – < 6.6.0.205 | Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files | MEDIUM 4.3 | 0.2 % | ||
| CVE-2024-8008 | 6.6.0 – < 6.6.0.211 | Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation | MEDIUM 5.2 | 0.6 % | ||
| CVE-2024-3509 | 6.6.0 – < 6.6.0.202 | Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor | MEDIUM 4.3 | 0.2 % | ||
| CVE-2024-7074 | 6.0.0 – < 6.0.0.21 ; 6.1.0 – < 6.1.0.38 ; 6.1.1 – < 6.1.1.42 ; … | Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution | MEDIUM 6.8 | 18 % | ||
| CVE-2025-2905 | 6.0.0 ; 6.1.0 ; 6.1.1 ; … | An XML External Entity (XXE) vulnerability in Multiple WSO2 Products | CRITICAL 9.1 | 1.3 % | ||
| CVE-2024-0392 | 6.6.0 – < 6.6.0.179 | Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation | MEDIUM 5.4 | 0.1 % | ||
| CVE-2023-6911 | 6.1.0.0 – < 6.1.0.9 ; 6.1.1.0 – < 6.1.1.9 ; 6.2.0.0 – < 6.2.0.7 ; … | Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be | MEDIUM 4.8 | 0.4 % | ||
| CVE-2023-6836 | 6.0.0.0 – < 6.0.0.3 ; 6.1.0.0 – < 6.1.0.5 ; 6.1.1.0 – < 6.1.1.5 ; … | Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely us | HIGH 7.5 | 0.5 % |