CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,436 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,436
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product wso2:enterprise_integrator. Show all products

15 CVEs, showing 1 to 15
CVESeverityTitlePublished
CVE-2024-4457Not yet scoredRemote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
Assigned by WSO2
Oct 18, 2026
CVE-2025-13394Medium 5.4The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks.Aug 6, 2026
CVE-2025-6670High 8.8A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event…Nov 18, 2025
CVE-2025-10853Medium 6.1A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding.Nov 5, 2025
CVE-2025-11093High 7.2An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines.Nov 5, 2025
CVE-2025-10907High 7.2An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services.Nov 5, 2025
CVE-2025-10713Critical 9.1An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser.Nov 5, 2025
CVE-2025-3125High 7.2An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint.Nov 5, 2025
CVE-2025-5605Medium 5.3An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products.Oct 24, 2025
CVE-2025-5350Medium 4.8SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users.Oct 24, 2025
CVE-2025-9955Medium 5.7An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store…Oct 16, 2025
CVE-2025-9804Medium 6.5An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs.Oct 16, 2025
CVE-2025-1862High 7.2An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint.Sep 26, 2025
CVE-2024-8008Medium 5.2Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Assigned by WSO2
Jun 2, 2025
CVE-2022-29464
Known exploited
Critical 9.8Certain WSO2 products allow unrestricted file upload with resultant remote code execution.
Assigned by mitre
Apr 18, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.