Login Request a demo
EI
Product
Enterprise Integrator
by Wso2 · last CVE Aug 6, 2026
On CISA KEVExploited in the wildRansomware-linked
33
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities33In the news0Timeline
Severity mix
Critical 2High 9Medium 22Low 0
Severity
All severities33Critical2High9Medium22Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Enterprise Integrator to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-29464
RansomwareIn wildKEV
9.8
100%
Apr 18
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
Affected: 6.2.0 through 6.6.0
CVE-2025-10713
9.1
0%
Nov 5
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
Affected: 6.6.0
CVE-2025-6670
8.8
0%
Nov 18
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
Affected: 6.6.0
CVE-2020-24703
8.8
1%
Aug 27
An issue was discovered in certain WSO2 products
Affected: through 6.6.0
CVE-2023-6836
7.5
0%
Dec 15
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access…
Affected: through 6.6.0
CVE-2025-11093
7.2
0%
Nov 5
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
Affected: 6.6.0 before 6.6.0.224
CVE-2025-10907
7.2
1%
Nov 5
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
Affected: 6.6.0
CVE-2025-3125
7.2
1%
Nov 5
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
Affected: 6.6.0
CVE-2025-1862
7.2
1%
Sep 26
Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
Affected: 6.6.0
CVE-2020-12719
7.2
1%
May 8
XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0,…
Affected: through 6.4.0
CVE-2020-11885
7.2
1%
Apr 17
WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as…
Affected: through 6.6.0
CVE-2025-9804
6.5
1%
Oct 16
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Affected: 6.2.0; 6.3.0
CVE-2020-24591
6.5
1%
Aug 21
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates
Affected: 6.2.0; 6.3.0
CVE-2025-10853
6.1
0%
Nov 5
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
Affected: 6.6.0
CVE-2022-39810
6.1
57%
Sep 9
An issue was discovered in WSO2 Enterprise Integrator 6.4.0
Affected: 6.4.0
CVE-2022-39809
6.1
1%
Sep 9
An issue was discovered in WSO2 Enterprise Integrator 6.4.0
Affected: 6.4.0
CVE-2022-29548
6.1
41%
Apr 21
A reflected XSS issue exists in the Management Console of several WSO2 products
Affected: 6.2.0; 6.3.0; 6.4.0; 6.5.0; 6.6.0
CVE-2020-17453
6.1
26%
Apr 5
WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter
Affected: through 6.6.0
CVE-2020-24704
6.1
1%
Aug 27
An issue was discovered in certain WSO2 products
Affected: through 6.6.0
CVE-2019-19587
6.1
1%
Dec 5
In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console
Affected: 6.5.0
CVE-2025-9955
5.7
0%
Oct 16
Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration
Affected: 6.0.0; 6.1.0; 6.1.1; 6.2.0; 6.3.0; 6.4.0; +2 more
CVE-2025-13394
5.4
0%
Aug 6
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Affected: 6.6.0 before 6.6.0.227
CVE-2024-0392
5.4
0%
Feb 27
Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation
Affected: 6.6.0
CVE-2020-25516
5.4
1%
Oct 29
WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks
Affected: through 6.6.0
CVE-2025-5605
5.3
1%
Oct 24
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
Affected: 6.6.0
CVE-2024-8008
5.2
1%
Jun 2
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Affected: 6.6.0
CVE-2025-5350
4.8
1%
Oct 24
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
Affected: 6.6.0
CVE-2023-6911
4.8
0%
Dec 18
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a…
Affected: 6.1.0; 6.1.1; 6.2.0; 6.3.0; 6.4.0; 6.5.0; +1 more
CVE-2019-20443
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 6.5.0
CVE-2019-20442
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 6.5.0
CVE-2017-14651
4.8
4%
Sep 21
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter
Affected: 6.1.1
CVE-2024-3511
4.3
0%
Jun 23
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
Affected: 6.6.0
CVE-2024-3509
4.3
0%
Jun 2
Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
Affected: 6.6.0
Showing 33