Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution

Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]