CVE-2024-8008Medium· 5.2▾ SunlitA reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a sp…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.
This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.
api_manager = 3.1.0api_manager = 3.2.0api_manager = 3.2.1api_manager = 4.0.0api_manager = 4.1.0api_manager = 4.2.0api_manager = 4.3.0enterprise_integrator = 6.6.0identity_server = 5.10.0identity_server = 5.11.0identity_server = 6.0.0identity_server = 6.1.0identity_server = 7.0.0identity_server_as_key_manager = 5.10.0open_banking_am = 2.0.0open_banking_iam = 2.0.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-6024Medium· 6.1The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint
CVE-2024-5139Medium· 6.1Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
CVE-2025-6623Medium· 4.3Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
CVE-2026-4103Medium· 6.4Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization
CVE-2025-0209Medium· 6.1A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding
CVE-2025-10503Medium· 6.1The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding