What’s Vulnerable › Products

WSO2 Enterprise Integrator vulnerabilities

40 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 23 published in the last 12 months.

Check whether your WSO2 Enterprise Integrator version is affected

Exploited WSO2 Enterprise Integrator vulnerabilities

• CVE-2022-29464 — WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Latest WSO2 Enterprise Integrator vulnerabilities

• CVE-2024-5139 — Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection (CVSS 6.1)
• CVE-2024-2323 — Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery (CVSS 4.8)
• CVE-2024-4412 — Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations (CVSS 2.7)
• CVE-2024-4457 — Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution (CVSS 9.1)
• CVE-2025-12317 — Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges (CVSS 5.0)
• CVE-2024-6541 — Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products (CVSS 6.8)
• CVE-2025-13394 — Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions (CVSS 5.4)
• CVE-2025-6670 — Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services (CVSS 8.8)
• CVE-2025-10853 — Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding (CVSS 6.1)
• CVE-2025-11093 — Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) (CVSS 7.2)
• CVE-2025-10907 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution (CVSS 7.2)
• CVE-2025-10713 — XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration (CVSS 9.1)
• CVE-2025-3125 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution (CVSS 7.2)
• CVE-2025-5605 — Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure (CVSS 5.3)
• CVE-2025-5350 — SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products (CVSS 4.8)
• CVE-2025-9955 — Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration (CVSS 5.7)
• CVE-2025-9804 — Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs (CVSS 6.5)
• CVE-2025-1862 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution (CVSS 7.2)
• CVE-2024-3511 — Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files (CVSS 4.3)
• CVE-2024-8008 — Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation (CVSS 5.2)
• CVE-2024-7074 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution (CVSS 6.8)
• CVE-2024-3509 — Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor (CVSS 4.3)
• CVE-2024-0392 — Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation (CVSS 5.4)
• CVE-2023-6911 — (CVSS 4.8)
• CVE-2023-6836 — (CVSS 7.5)