Api Manager Analytics (Wso2) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 78 known versions, newest CVE from 2025-10-16. Vendor: Wso2.
CVEs of Api Manager Analytics
- CVE-2025-9804 - CVSS 9.6 (critical), 2025-10-16: An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services…
- CVE-2023-6911 - CVSS 4.8 (medium), 2023-12-18: Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an…
- CVE-2023-6836 - CVSS 7.5 (high), 2023-12-15: Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML…
- CVE-2022-29548 - CVSS 6.1 (medium), 2022-04-21: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0;…
- CVE-2020-17453 - CVSS 6.1 (medium), 2021-04-05: WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
- CVE-2020-24703 - CVSS 8.8 (high), 2020-08-27: An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim…
- CVE-2020-24706 - CVSS 6.1 (medium), 2020-08-27: An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0,…
- CVE-2020-24705 - CVSS 8.8 (high), 2020-08-27: An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim…
- CVE-2020-24704 - CVSS 6.1 (medium), 2020-08-27: An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API…
- CVE-2020-24591 - CVSS 6.5 (medium), 2020-08-21: The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics…
- CVE-2020-12719 - CVSS 8.7 (high), 2020-05-08: XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API…
