Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

WSO2 Open Banking IAM Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Published	Severity
`CVE-2025-12737`Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution	Exploitation statusNot known exploited	FixYes	Published09/03/2026	SeverityHigh
`CVE-2025-15039`Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityCritical
`CVE-2026-0637`Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2025-13394`Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2025-13736`Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityLow
`CVE-2024-10302`Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2024-6832`Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2024-8995`Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access	Exploitation statusNot known exploited	FixYes	Published08/06/2026	SeverityMedium
`CVE-2025-8591`Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification	Exploitation statusNot known exploited	FixYes	Published07/06/2026	SeverityMedium
`CVE-2024-1248`Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation	Exploitation statusNot known exploited	FixYes	Published07/04/2026	SeverityMedium
`CVE-2024-0391`Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery	Exploitation statusNot known exploited	FixYes	Published05/11/2026	SeverityMedium
`CVE-2024-2374`XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service	Exploitation statusNot known exploited	FixYes	Published04/16/2026	SeverityHigh
`CVE-2025-9312`Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products	Exploitation statusNot known exploited	FixYes	Published11/18/2025	SeverityCritical
`CVE-2025-6670`Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services	Exploitation statusNot known exploited	FixYes	Published11/18/2025	SeverityHigh
`CVE-2025-10853`Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding	Exploitation statusNot known exploited	FixYes	Published11/05/2025	SeverityMedium
`CVE-2025-11093`Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)	Exploitation statusNot known exploited	FixYes	Published11/05/2025	SeverityHigh
`CVE-2025-10907`Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution	Exploitation statusNot known exploited	FixYes	Published11/05/2025	SeverityHigh
`CVE-2025-10713`XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration	Exploitation statusNot known exploited	FixYes	Published11/05/2025	SeverityMedium
`CVE-2025-3125`Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution	Exploitation statusNot known exploited	FixYes	Published11/05/2025	SeverityMedium
`CVE-2025-5605`Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure	Exploitation statusNot known exploited	FixYes	Published10/24/2025	SeverityMedium
`CVE-2025-5350`SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products	Exploitation statusNot known exploited	FixYes	Published10/24/2025	SeverityMedium
`CVE-2025-9804`Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs	Exploitation statusNot known exploited	FixYes	Published10/16/2025	SeverityCritical
`CVE-2025-10611`Potential Broken Access Control in Multiple WSO2 Products via System REST APIs	Exploitation statusNot known exploited	FixYes	Published10/16/2025	SeverityCritical
`CVE-2025-1862`Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution	Exploitation statusNot known exploited	FixYes	Published09/26/2025	SeverityMedium
`CVE-2025-1396`Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled	Exploitation statusNot known exploited	FixYes	Published09/26/2025	SeverityLow
`CVE-2025-0672`Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association	Exploitation statusNot known exploited	FixYes	Published09/23/2025	SeverityLow
`CVE-2025-0663`Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login	Exploitation statusNot known exploited	FixYes	Published09/23/2025	SeverityMedium
`CVE-2024-3511`Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files	Exploitation statusNot known exploited	FixYes	Published06/23/2025	SeverityMedium
`CVE-2024-1440`Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint	Exploitation statusNot known exploited	FixYes	Published06/02/2025	SeverityMedium
`CVE-2024-8008`Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation	Exploitation statusNot known exploited	FixYes	Published06/02/2025	SeverityMedium
`CVE-2024-3509`Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor	Exploitation statusNot known exploited	FixYes	Published06/02/2025	SeverityMedium
`CVE-2024-7073`Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services	Exploitation statusNot known exploited	FixYes	Published06/02/2025	SeverityMedium
`CVE-2024-7097`Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup	Exploitation statusNot known exploited	FixYes	Published05/30/2025	SeverityMedium
`CVE-2024-7096`Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw	Exploitation statusNot known exploited	FixYes	Published05/30/2025	SeverityMedium
`CVE-2024-6914`Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover	Exploitation statusNot known exploited	FixYes	Published05/22/2025	SeverityCritical

35 / 35 Results

All vulnerabilities loaded

Security vulnerabilities in WSO2 Open Banking IAM

WSO2 Open Banking IAM

Verify to analyze this security profile

How many security vulnerabilities does WSO2 Open Banking IAM have?

Does the latest WSO2 Open Banking IAM version have known vulnerabilities?

Run an in-depth assessment with complete web risk management