WE
Product
WSO2 Enterprise Integrator
25
CVEs
0
On KEV
9.1
Max CVSS
4
New 30D
Severity mix
Critical 3High 6Medium 15Low 1
Watch
Add WSO2 Enterprise Integrator to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-6541 | 6.8 | Aug 6 | Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products Affected: 6.6.0 before 6.6.0.205 |
| CVE-2024-7074 | 6.8 | Jun 2 | Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution Affected: 6.0.0 before 6.0.0.21; 6.1.0 before 6.1.0.38; 6.1.1 before 6.1.1.42; 6.2.0 before 6.2.0.61; 6.3.0 before 6.3.0.69; 6.4.0 before 6.4.0.96; +2 more |
| CVE-2025-9804 | 6.5 | Oct 16 | Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs Affected: 6.2.0 before 6.2.0.62; 6.3.0 before 6.3.0.70 |
| CVE-2024-5139 | 6.1 | Oct 21 | Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection Affected: 6.6.0 before 6.6.0.204 |
| CVE-2025-10853 | 6.1 | Nov 5 | Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding Affected: 6.6.0 before 6.6.0.223 |
| CVE-2025-9955 | 5.7 | Oct 16 | Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration Affected: 6.0.0 before 6.0.0.22; 6.1.0 before 6.1.0.39; 6.1.1 before 6.1.1.43; 6.2.0 before 6.2.0.62; 6.3.0 before 6.3.0.70; 6.4.0 before 6.4.0.100; +2 more |
| CVE-2025-13394 | 5.4 | Aug 6 | Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions Affected: 6.6.0 before 6.6.0.227 |
| CVE-2024-0392 | 5.4 | Feb 27 | Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation Affected: 6.6.0 before 6.6.0.179 |
| CVE-2025-5605 | 5.3 | Oct 24 | Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure Affected: 6.6.0 before 6.6.0.217 |
| CVE-2024-8008 | 5.2 | Jun 2 | Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation Affected: 6.6.0 before 6.6.0.211 |
| CVE-2025-12317 | 5.0 | Aug 6 | Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges Affected: 6.6.0 before 6.6.0.228 |
| CVE-2024-2323 | 4.8 | Oct 20 | Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery Affected: 6.6.0 before 6.6.0.204 |
| CVE-2025-5350 | 4.8 | Oct 24 | SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products Affected: 6.6.0 before 6.6.0.218 |
| CVE-2024-3511 | 4.3 | Jun 23 | Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files Affected: 6.6.0 before 6.6.0.205 |
| CVE-2024-3509 | 4.3 | Jun 2 | Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor Affected: 6.6.0 before 6.6.0.202 |
Showing 15