{"id":"CVE-2025-6623","title":"Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection","summary":"The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.\n\nSuccessful exploitation allows a remote attacker to execute arbitrary Java…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"WSO2","product":"WSO2 API Manager","affected":["api_manager >= 3.2.0 < 3.2.0.433","api_manager >= 3.2.1 < 3.2.1.53","api_manager >= 4.1.0 < 4.1.0.215","api_manager >= 4.2.0 < 4.2.0.153","api_manager >= 4.3.0 < 4.3.0.66","api_manager >= 4.4.0 < 4.4.0.29","api_manager >= 4.5.0 < 4.5.0.11","universal_gateway >= 4.5.0 < 4.5.0.11","traffic_manager >= 4.5.0 < 4.5.0.11","api_control_plane >= 4.5.0 < 4.5.0.12","org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.26 < 5.2.26.19","org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.41 < 5.2.41.6","org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.57 < 5.2.57.7","org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.5 < 5.3.5.4","org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.11 < 5.3.11.4","org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.15 < 5.3.15.3","org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.20 < 5.3.20.1","org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.26 < 5.2.26.19","org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.41 < 5.2.41.6","org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.57 < 5.2.57.7","org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.5 < 5.3.5.4","org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.11 < 5.3.11.4","org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.15 < 5.3.15.3","org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.20 < 5.3.20.1"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T16:25:50.419Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-6623","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/"},{"url":"https://github.com/wso2/carbon-analytics-common/pull/870"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T17:33:42.478Z","slug":"CVE-2025-6623","body":"## Overview\n\nThe carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.\n\nSuccessful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.\n\n## Affected\n\n- `api_manager >= 3.2.0 < 3.2.0.433`\n- `api_manager >= 3.2.1 < 3.2.1.53`\n- `api_manager >= 4.1.0 < 4.1.0.215`\n- `api_manager >= 4.2.0 < 4.2.0.153`\n- `api_manager >= 4.3.0 < 4.3.0.66`\n- `api_manager >= 4.4.0 < 4.4.0.29`\n- `api_manager >= 4.5.0 < 4.5.0.11`\n- `universal_gateway >= 4.5.0 < 4.5.0.11`\n- `traffic_manager >= 4.5.0 < 4.5.0.11`\n- `api_control_plane >= 4.5.0 < 4.5.0.12`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.26 < 5.2.26.19`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.41 < 5.2.41.6`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.57 < 5.2.57.7`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.5 < 5.3.5.4`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.11 < 5.3.11.4`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.15 < 5.3.15.3`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.20 < 5.3.20.1`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.26 < 5.2.26.19`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.41 < 5.2.41.6`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.57 < 5.2.57.7`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.5 < 5.3.5.4`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.11 < 5.3.11.4`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.15 < 5.3.15.3`\n- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.20 < 5.3.20.1`\n\n## Remediation\n\nFollow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/#solution","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}