Skip to content
OpenAdvisories

Product · WSO2

WSO2 Carbon API Management Implementation

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-2613

    SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

    The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enab…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Traffic Manager
  • High 8.7
    CVE-2026-3415

    XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

    The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during…

    WSO2 WSO2 API Manager WSO2 API Control Plane WSO2 Universal Gateway