Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

open_banking_iam Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Published	Severity
`CVE-2025-12737`Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution	Exploitation statusNot known exploited	FixYes	Published09/03/2026	SeverityHigh
`CVE-2025-15039`Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityCritical
`CVE-2026-0637`Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2025-13394`Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2025-13736`Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityLow
`CVE-2024-10302`Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2024-6832`Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2024-8995`Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2025-8591`Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification	Exploitation statusNot known exploited	FixYes	Published07/06/2026	SeverityMedium
`CVE-2024-1248`Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation	Exploitation statusNot known exploited	FixYes	Published07/04/2026	SeverityMedium
`CVE-2024-0391`Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery	Exploitation statusNot known exploited	FixYes	Published05/11/2026	SeverityMedium
`CVE-2024-2374`XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service	Exploitation statusNot known exploited	FixYes	Published04/16/2026	SeverityHigh
`CVE-2025-9312`Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products	Exploitation statusNot known exploited	FixYes	Published11/18/2025	SeverityCritical
`CVE-2025-6670`Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services	Exploitation statusNot known exploited	FixYes	Published11/18/2025	SeverityHigh
`CVE-2025-10853`Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding	Exploitation statusNot known exploited	FixYes	Published11/05/2025	SeverityMedium
`CVE-2025-10907`Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution	Exploitation statusNot known exploited	FixYes	Published11/05/2025	SeverityHigh
`CVE-2025-10713`XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration	Exploitation statusNot known exploited	FixYes	Published11/05/2025	SeverityMedium
`CVE-2025-3125`Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution	Exploitation statusNot known exploited	FixYes	Published11/05/2025	SeverityMedium
`CVE-2025-5605`Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure	Exploitation statusNot known exploited	FixYes	Published10/24/2025	SeverityMedium
`CVE-2025-5350`SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products	Exploitation statusNot known exploited	FixYes	Published10/24/2025	SeverityMedium
`CVE-2025-9804`Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs	Exploitation statusNot known exploited	FixYes	Published10/16/2025	SeverityCritical
`CVE-2025-10611`Potential Broken Access Control in Multiple WSO2 Products via System REST APIs	Exploitation statusNot known exploited	FixYes	Published10/16/2025	SeverityCritical
`CVE-2025-1862`Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution	Exploitation statusNot known exploited	FixYes	Published09/26/2025	SeverityMedium
`CVE-2025-1396`Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled	Exploitation statusNot known exploited	FixYes	Published09/26/2025	SeverityLow
`CVE-2025-0672`Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association	Exploitation statusNot known exploited	FixYes	Published09/23/2025	SeverityLow
`CVE-2025-0663`Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login	Exploitation statusNot known exploited	FixYes	Published09/23/2025	SeverityMedium
`CVE-2024-3511`Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files	Exploitation statusNot known exploited	FixYes	Published06/23/2025	SeverityMedium
`CVE-2024-8008`Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation	Exploitation statusNot known exploited	FixYes	Published06/02/2025	SeverityMedium
`CVE-2024-7073`Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services	Exploitation statusNot known exploited	FixYes	Published06/02/2025	SeverityMedium
`CVE-2024-7097`Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup	Exploitation statusNot known exploited	FixYes	Published05/30/2025	SeverityMedium
`CVE-2024-7096`Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw	Exploitation statusNot known exploited	FixYes	Published05/30/2025	SeverityMedium
`CVE-2024-6914`Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover	Exploitation statusNot known exploited	FixYes	Published05/22/2025	SeverityCritical
`CVE-2022-29464`CVE-2022-29464	Exploitation statusKEV	FixNot confirmed	Published04/18/2022	SeverityCritical

33 / 33 Results

All vulnerabilities loaded

Security vulnerabilities in open_banking_iam

open_banking_iam

Verify to analyze this security profile

How many security vulnerabilities does open_banking_iam have?

Does the latest open_banking_iam version have known vulnerabilities?

Run an in-depth assessment with complete web risk management