Login Request a demo
WE
Product
WSO2 Enterprise Integrator
by WSO2 · last CVE Oct 21, 2026
25
CVEs
0
On KEV
9.1
Max CVSS
4
New 30D
Vulnerabilities25In the news0Timeline
Severity mix
Critical 3High 6Medium 15Low 1
Severity
All severities25Critical3High6Medium15Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add WSO2 Enterprise Integrator to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-4457
9.1
0%
Oct 18
Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
Affected: 6.6.0 before 6.6.0.204
CVE-2025-10713
9.1
0%
Nov 5
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
Affected: 6.6.0 before 6.6.0.223
CVE-2025-2905
9.1
1%
May 5
An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
Affected: 6.0.0; 6.1.0; 6.1.1; 6.2.0; 6.3.0; 6.4.0; +2 more
CVE-2025-6670
8.8
0%
Nov 18
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
Affected: 6.6.0 before 6.6.0.226
CVE-2024-6832
7.5
0%
Aug 6
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
Affected: 6.6.0 before 6.6.0.229
CVE-2025-11093
7.2
0%
Nov 5
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
Affected: 6.6.0 before 6.6.0.224
CVE-2025-10907
7.2
1%
Nov 5
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
Affected: 6.6.0 before 6.6.0.224
CVE-2025-3125
7.2
1%
Nov 5
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
Affected: 6.6.0 before 6.6.0.217
CVE-2025-1862
7.2
1%
Sep 26
Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
Affected: 6.6.0 before 6.6.0.215
CVE-2024-6541
6.8
0%
Aug 6
Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
Affected: 6.6.0 before 6.6.0.205
CVE-2024-7074
6.8
17%
Jun 2
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
Affected: 6.0.0 before 6.0.0.21; 6.1.0 before 6.1.0.38; 6.1.1 before 6.1.1.42; 6.2.0 before 6.2.0.61; 6.3.0 before 6.3.0.69; 6.4.0 before 6.4.0.96; +2 more
CVE-2025-9804
6.5
1%
Oct 16
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Affected: 6.2.0 before 6.2.0.62; 6.3.0 before 6.3.0.70
CVE-2024-5139
6.1
0%
Oct 21
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
Affected: 6.6.0 before 6.6.0.204
CVE-2025-10853
6.1
0%
Nov 5
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
Affected: 6.6.0 before 6.6.0.223
CVE-2025-9955
5.7
0%
Oct 16
Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration
Affected: 6.0.0 before 6.0.0.22; 6.1.0 before 6.1.0.39; 6.1.1 before 6.1.1.43; 6.2.0 before 6.2.0.62; 6.3.0 before 6.3.0.70; 6.4.0 before 6.4.0.100; +2 more
CVE-2025-13394
5.4
0%
Aug 6
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Affected: 6.6.0 before 6.6.0.227
CVE-2024-0392
5.4
0%
Feb 27
Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation
Affected: 6.6.0 before 6.6.0.179
CVE-2025-5605
5.3
1%
Oct 24
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
Affected: 6.6.0 before 6.6.0.217
CVE-2024-8008
5.2
1%
Jun 2
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Affected: 6.6.0 before 6.6.0.211
CVE-2025-12317
5.0
0%
Aug 6
Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
Affected: 6.6.0 before 6.6.0.228
CVE-2024-2323
4.8
0%
Oct 20
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
Affected: 6.6.0 before 6.6.0.204
CVE-2025-5350
4.8
1%
Oct 24
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
Affected: 6.6.0 before 6.6.0.218
CVE-2024-3511
4.3
0%
Jun 23
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
Affected: 6.6.0 before 6.6.0.205
CVE-2024-3509
4.3
0%
Jun 2
Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
Affected: 6.6.0 before 6.6.0.202
CVE-2024-4412
2.7
0%
Oct 19
Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
Affected: 6.6.0 before 6.6.0.205
Showing 25