https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 05:45:17 +0000 https://cve.radiocsirt.org/vuln/cve-2025-4760 <p><strong>Affected:</strong> WSO2 API Manager, WSO2 API Control Plane, WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 Carbon API Management API</p> <p>An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.</p> <p>A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.</p> <p><strong>Affected:</strong> WSO2 API Manager, WSO2 API Control Plane, WSO2 Universal Gateway, WSO2 Traffic Manager, WSO2 Carbon API Management API</p> <p>An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.</p> <p>A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.</p> https://cve.radiocsirt.org/vuln/cve-2025-4760