Filtered by vendor Wso2 Subscriptions
Filtered by product Api Control Plane Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-9152 1 Wso2 2 Api Control Plane, Api Manager 2025-10-21 9.8 Critical
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.
CVE-2025-10611 1 Wso2 10 Api Control Plane, Api Manager, Carbon and 7 more 2025-10-21 9.8 Critical
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.
CVE-2025-9804 1 Wso2 16 Api Control Plane, Api Manager, Api Manager Analytics and 13 more 2025-10-21 8.9 High
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
CVE-2025-5717 1 Wso2 5 Api Control Plane, Api Manager, Open Banking Am and 2 more 2025-09-25 6.7 Medium
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server. Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users.
CVE-2025-4760 1 Wso2 5 Api Control Plane, Api Manager, Carbon Api Management Api and 2 more 2025-09-25 4.8 Medium
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.