CVE-2025-6623Medium· 4.3▾ SunlitThe carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary Java…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.
Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
api_manager >= 3.2.0 < 3.2.0.433api_manager >= 3.2.1 < 3.2.1.53api_manager >= 4.1.0 < 4.1.0.215api_manager >= 4.2.0 < 4.2.0.153api_manager >= 4.3.0 < 4.3.0.66api_manager >= 4.4.0 < 4.4.0.29api_manager >= 4.5.0 < 4.5.0.11universal_gateway >= 4.5.0 < 4.5.0.11traffic_manager >= 4.5.0 < 4.5.0.11api_control_plane >= 4.5.0 < 4.5.0.12org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.26 < 5.2.26.19org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.41 < 5.2.41.6org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.57 < 5.2.57.7org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.5 < 5.3.5.4org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.11 < 5.3.11.4org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.15 < 5.3.15.3org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.20 < 5.3.20.1org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.26 < 5.2.26.19org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.41 < 5.2.41.6org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.57 < 5.2.57.7org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.5 < 5.3.5.4org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.11 < 5.3.11.4org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.15 < 5.3.15.3org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.20 < 5.3.20.1Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-7043Medium· 5.4Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
CVE-2024-8008Medium· 5.2Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
CVE-2025-13590Critical· 9.1Authenticated arbitrary file upload via a System REST API requiring administrator permission.
CVE-2026-3418Critical· 9.1Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
CVE-2026-3415High· 8.7XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
CVE-2025-5802Medium· 5.3The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence