CVE-2025-10853

mediumpriority · track · 24EPSS 0.002 · 9 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.19% (9th) EPSS

CVSS 6.1 · medium

Is it mine?

83 products

Check your exposure

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-27

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7

v3.15.2mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.15.2mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondaryexploitability 2.1 · impact 2.7

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79US

affected products (83)

Products and version ranges known to be affected.

WSO2 WSO2 API Control Plane4.5.0 → 4.5.0.27enisa_euvdEU
WSO2 WSO2 API Manager3.1.0 → 3.1.0.344enisa_euvdEU
WSO2 WSO2 API Manager3.2.0 → 3.2.0.445enisa_euvdEU
WSO2 WSO2 API Manager3.2.1 → 3.2.1.65enisa_euvdEU
WSO2 WSO2 API Manager4.0.0 → 4.0.0.365enisa_euvdEU
WSO2 WSO2 API Manager4.1.0 → 4.1.0.227enisa_euvdEU
WSO2 WSO2 API Manager4.2.0 → 4.2.0.167enisa_euvdEU
WSO2 WSO2 API Manager4.3.0 → 4.3.0.79enisa_euvdEU
WSO2 WSO2 API Manager4.4.0 → 4.4.0.43enisa_euvdEU
WSO2 WSO2 API Manager4.5.0 → 4.5.0.26enisa_euvdEU
WSO2 WSO2 Enterprise Integrator6.6.0 → 6.6.0.223enisa_euvdEU
WSO2 WSO2 Identity Server5.10.0 → 5.10.0.373enisa_euvdEU
WSO2 WSO2 Identity Server5.11.0 → 5.11.0.417enisa_euvdEU
WSO2 WSO2 Identity Server6.0.0 → 6.0.0.247enisa_euvdEU
WSO2 WSO2 Identity Server6.1.0 → 6.1.0.246enisa_euvdEU
WSO2 WSO2 Identity Server7.0.0 → 7.0.0.122enisa_euvdEU
WSO2 WSO2 Identity Server7.1.0 → 7.1.0.29enisa_euvdEU
WSO2 WSO2 Identity Server as Key Manager5.10.0 → 5.10.0.363enisa_euvdEU
WSO2 WSO2 Open Banking AM2.0.0 → 2.0.0.393enisa_euvdEU
WSO2 WSO2 Open Banking IAM2.0.0 → 2.0.0.413enisa_euvdEU

showing 20 of 83

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd NVD CVE.org MITRE

published 2025-11-05modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan