EI
Product
Enterprise Integrator
On CISA KEVExploited in the wildRansomware-linked
33
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 9Medium 22Low 0
Watch
Add Enterprise Integrator to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-29464 RansomwareIn wildKEV | 9.8 | Apr 18 | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability Affected: 6.2.0 through 6.6.0 |
| CVE-2025-10713 | 9.1 | Nov 5 | An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser Affected: 6.6.0 |
| CVE-2025-6670 | 8.8 | Nov 18 | A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services,… Affected: 6.6.0 |
| CVE-2020-24703 | 8.8 | Aug 27 | An issue was discovered in certain WSO2 products Affected: through 6.6.0 |
| CVE-2023-6836 | 7.5 | Dec 15 | Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access… Affected: through 6.6.0 |
| CVE-2025-11093 | 7.2 | Nov 5 | An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines Affected: 6.6.0 before 6.6.0.224 |
| CVE-2025-10907 | 7.2 | Nov 5 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services Affected: 6.6.0 |
| CVE-2025-3125 | 7.2 | Nov 5 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint Affected: 6.6.0 |
| CVE-2025-1862 | 7.2 | Sep 26 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint Affected: 6.6.0 |
| CVE-2020-12719 | 7.2 | May 8 | XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0,… Affected: through 6.4.0 |
| CVE-2020-11885 | 7.2 | Apr 17 | WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as… Affected: through 6.6.0 |
| CVE-2025-9804 | 6.5 | Oct 16 | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs Affected: 6.2.0; 6.3.0 |
| CVE-2020-24591 | 6.5 | Aug 21 | The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates Affected: 6.2.0; 6.3.0 |
| CVE-2025-10853 | 6.1 | Nov 5 | A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding Affected: 6.6.0 |
| CVE-2022-39810 | 6.1 | Sep 9 | An issue was discovered in WSO2 Enterprise Integrator 6.4.0 Affected: 6.4.0 |
| CVE-2022-39809 | 6.1 | Sep 9 | An issue was discovered in WSO2 Enterprise Integrator 6.4.0 Affected: 6.4.0 |
| CVE-2022-29548 | 6.1 | Apr 21 | A reflected XSS issue exists in the Management Console of several WSO2 products Affected: 6.2.0; 6.3.0; 6.4.0; 6.5.0; 6.6.0 |
| CVE-2020-17453 | 6.1 | Apr 5 | WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter Affected: through 6.6.0 |
| CVE-2020-24704 | 6.1 | Aug 27 | An issue was discovered in certain WSO2 products Affected: through 6.6.0 |
| CVE-2019-19587 | 6.1 | Dec 5 | In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console Affected: 6.5.0 |
| CVE-2025-9955 | 5.7 | Oct 16 | An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system… Affected: 6.0.0; 6.1.0; 6.1.1; 6.2.0; 6.3.0; 6.4.0; +2 more |
| CVE-2025-13394 | 5.4 | Aug 6 | Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions Affected: 6.6.0 before 6.6.0.227 |
| CVE-2024-0392 | 5.4 | Feb 27 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation Affected: 6.6.0 |
| CVE-2020-25516 | 5.4 | Oct 29 | WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks Affected: through 6.6.0 |
| CVE-2025-5605 | 5.3 | Oct 24 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products Affected: 6.6.0 |
| CVE-2024-8008 | 5.2 | Jun 2 | Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation Affected: 6.6.0 |
| CVE-2025-5350 | 4.8 | Oct 24 | SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users Affected: 6.6.0 |
| CVE-2023-6911 | 4.8 | Dec 18 | Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a… Affected: 6.1.0; 6.1.1; 6.2.0; 6.3.0; 6.4.0; 6.5.0; +1 more |
| CVE-2019-20443 | 4.8 | Jan 28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0 Affected: 6.5.0 |
| CVE-2019-20442 | 4.8 | Jan 28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0 Affected: 6.5.0 |
| CVE-2017-14651 | 4.8 | Sep 21 | WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter Affected: 6.1.1 |
| CVE-2024-3511 | 4.3 | Jun 23 | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry Affected: 6.6.0 |
| CVE-2024-3509 | 4.3 | Jun 2 | A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within… Affected: 6.6.0 |
Showing 33