What’s Vulnerable › Products

WSO2 Open Banking Iam vulnerabilities

38 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 37 published in the last 12 months.

Check whether your WSO2 Open Banking Iam version is affected

Exploited WSO2 Open Banking Iam vulnerabilities

• CVE-2022-29464 — WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Latest WSO2 Open Banking Iam vulnerabilities

• CVE-2026-3583 — Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] (CVSS 3.1)
• CVE-2025-14260 — Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources (CVSS 8.3)
• CVE-2024-6423 — Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage (CVSS 4.0)
• CVE-2024-7478 — Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.8)
• CVE-2024-5139 — Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection (CVSS 6.1)
• CVE-2025-12737 — Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution (CVSS 8.4)
• CVE-2026-0637 — Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products (CVSS 4.4)
• CVE-2025-15039 — Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products (CVSS 9.4)
• CVE-2025-13736 — Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery (CVSS 3.7)
• CVE-2025-13394 — Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions (CVSS 5.4)
• CVE-2024-8995 — Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access (CVSS 4.9)
• CVE-2024-6832 — Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks (CVSS 7.5)
• CVE-2024-10302 — Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure (CVSS 5.8)
• CVE-2025-8591 — Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification (CVSS 6.1)
• CVE-2024-1248 — Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation (CVSS 5.3)
• CVE-2024-0391 — Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 4.3)
• CVE-2024-2374 — XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service (CVSS 9.1)
• CVE-2025-9312 — Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products (CVSS 9.8)
• CVE-2025-6670 — Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services (CVSS 8.8)
• CVE-2025-10853 — Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding (CVSS 6.1)
• CVE-2025-10907 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution (CVSS 7.2)
• CVE-2025-10713 — XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration (CVSS 9.1)
• CVE-2025-3125 — Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution (CVSS 7.2)
• CVE-2025-5605 — Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure (CVSS 5.3)
• CVE-2025-5350 — SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products (CVSS 4.8)