WSO2 Micro Integrator vulnerabilities

5 CVEs affecting WSO2 Micro Integrator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-11093, published 2025-11-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-29548, published 2022-04-21. Medium severity, CVSS 6.1. EPSS: 41.1% chance of exploitation in the next 30 days. A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and…
CVE-2020-17453, published 2021-04-05. Medium severity, CVSS 6.1. EPSS: 26.2% chance of exploitation in the next 30 days. WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
CVE-2023-6836, published 2023-12-15. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.
CVE-2025-11093, published 2025-11-05. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated…
CVE-2024-4598, published 2025-09-23. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from…