Wso2 Open_banking_am
19 CVEs affecting Wso2 Open_banking_am. Latest disclosed: 2026-07-06. Critical: 5, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9312 | Critical | 9.8 | 2025-11-18 | A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 p… |
CVE-2025-10611 | Critical | 9.8 | 2025-10-16 | Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed… |
CVE-2024-6914 | Critical | 9.8 | 2025-05-22 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A ma… |
CVE-2022-29464 | Critical | 9.8 | 2022-04-18 | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposit… |
CVE-2025-9804 | Critical | 9.6 | 2025-10-16 | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services an… |
CVE-2025-6670 | High | 8.8 | 2025-11-18 | A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within a… |
CVE-2025-10907 | High | 8.4 | 2025-11-05 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin servic… |
CVE-2024-2374 | High | 7.5 | 2026-04-16 | The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This o… |
CVE-2025-5717 | Medium | 6.8 | 2025-09-23 | An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin servi… |
CVE-2025-10713 | Medium | 6.5 | 2025-11-05 | An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-suppli… |
CVE-2025-8591 | Medium | 6.1 | 2026-07-06 | The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition a… |
CVE-2025-5350 | Medium | 5.9 | 2025-10-24 | SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users… |
CVE-2025-10853 | Medium | 5.2 | 2025-11-05 | A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering w… |
CVE-2024-8008 | Medium | 5.2 | 2025-06-02 | A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JD… |
CVE-2024-1248 | Medium | 4.8 | 2026-07-04 | The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation w… |
CVE-2025-5605 | Medium | 4.3 | 2025-10-24 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate… |
CVE-2024-3511 | Medium | 4.3 | 2025-06-23 | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to fla… |
CVE-2024-7097 | Medium | 4.3 | 2025-05-30 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardles… |
CVE-2024-7096 | Medium | 4.2 | 2025-05-30 | A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new u… |