WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product api manager✕Has a public PoC✕
Overview 8 matches · 2 in Waratek scope · 0 protected · 5 exploited · 1 CISA KEV · 1 EPSS ≥ 0.5
8matches 2in Waratek scope25.0% 0protected0.0% 5exploited62.5% 1CISA KEV12.5% 1EPSS ≥ 0.512.5%
Protected by Waratek 0 0.0% Rule in development 1 12.5% Mitigation candidate 1 12.5% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 6 75.0% Withdrawn CVE 0 0.0%
Critical 2 25.0% High 0 0.0% Medium 6 75.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 5 62.5% Working exploit published 3 37.5% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 6Mitigation candidate: 1Rule in development: 1 Medium: 6Critical: 2 not blocked: 8 Working exploit published: 3Exploited: 5
20171 Not applicable1 Medium1 not blocked1 Working exploit published1 20180 20190 20201 Not applicable1 Critical1 not blocked1 Exploited1 20211 Not applicable1 Medium1 not blocked1 Exploited1 20222 Not applicable2 Critical1 Medium1 not blocked2 Exploited1 Working exploit published1 20230 20240 20253 Rule in development1 Mitigation candidate1 Not applicable1 Medium3 not blocked3 Exploited2 Working exploit published1
201720182019202020212022202320242025
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-5605 Medium 2025-10-24 Mitigation candidate Exploited An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.
CVE-2025-5350 Medium 2025-10-24 Rule in development Working exploit published SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context. By tricking an administrator into accessing a crafted link, an attacker could force the server to fetch malicious content and reflect it into the admin’s browser, leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a significant security risk. Furthermore, SSRF can be used by a privileged user to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable from the affected product.
CVE-2024-7097 Medium 2025-05-30 Not applicable Exploited An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation.
CVE-2022-29548 Medium 2022-04-21 Not applicable Working exploit published A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.
CVE-2022-29464 Critical 2022-04-18 Not applicable Exploited Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
CVE-2020-17453 Medium 2021-04-05 Not applicable Exploited WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
CVE-2020-24589 Critical 2020-08-21 Not applicable Exploited The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.
CVE-2017-14651 Medium 2017-09-21 Not applicable Working exploit published WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.