CVE-2025-10713

criticalpriority · track · 36EPSS 0.005 · 39 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.46% (39th) EPSS

CVSS 9.1 · critical

Is it mine?

47 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · osv

EPSS · scored 2026-10-27

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.5–9.1

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.2

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Hsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Hsecondaryexploitability 1.2 · impact 5.2

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Hsecondary · OSV

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-611USCWE-611US

affected products (47)

Products and version ranges known to be affected.

WSO2 WSO2 API Control Plane4.5.0 → 4.5.0.27enisa_euvdEU
WSO2 WSO2 API Manager3.1.0 → 3.1.0.344enisa_euvdEU
WSO2 WSO2 API Manager3.2.0 → 3.2.0.445enisa_euvdEU
WSO2 WSO2 API Manager3.2.1 → 3.2.1.65enisa_euvdEU
WSO2 WSO2 API Manager4.0.0 → 4.0.0.365enisa_euvdEU
WSO2 WSO2 API Manager4.1.0 → 4.1.0.227enisa_euvdEU
WSO2 WSO2 API Manager4.2.0 → 4.2.0.167enisa_euvdEU
WSO2 WSO2 API Manager4.3.0 → 4.3.0.79enisa_euvdEU
WSO2 WSO2 API Manager4.4.0 → 4.4.0.43enisa_euvdEU
WSO2 WSO2 API Manager4.5.0 → 4.5.0.26enisa_euvdEU
WSO2 WSO2 Enterprise Integrator6.6.0 → 6.6.0.223enisa_euvdEU
WSO2 WSO2 Identity Server5.10.0 → 5.10.0.373enisa_euvdEU
WSO2 WSO2 Identity Server5.11.0 → 5.11.0.417enisa_euvdEU
WSO2 WSO2 Identity Server7.1.0 → 7.1.0.29enisa_euvdEU
WSO2 WSO2 Identity Server as Key Manager5.10.0 → 5.10.0.363enisa_euvdEU
WSO2 WSO2 Open Banking AM2.0.0 → 2.0.0.393enisa_euvdEU
WSO2 WSO2 Open Banking IAM2.0.0 → 2.0.0.413enisa_euvdEU
WSO2 WSO2 Traffic Manager4.5.0 → 4.5.0.25enisa_euvdEU
WSO2 WSO2 Universal Gateway4.5.0 → 4.5.0.25enisa_euvdEU
WSO2 org.wso2.carbon.mediation:org.wso2.carbon.localentry4.7.131 → 4.7.131.21enisa_euvdEU

showing 20 of 47

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-fvfq-q238-j7j3WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks2025-11-05ghsa · osvUS
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv NVD CVE.org MITRE

published 2025-11-05modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan