CVE-2025-10853

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS.

Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
WSO2WSO2 Open Banking IAM>= 2.0.0, < 2.0.0.413
WSO2WSO2 API Manager>= 3.1.0, < 3.1.0.344; >= 3.2.0, < 3.2.0.445; >= 3.2.1, < 3.2.1.65; >= 4.0.0, < 4.0.0.365; >= 4.1.0, < 4.1.0.227; >= 4.2.0, < 4.2.0.167; >= 4.3.0, < 4.3.0.79; >= 4.4.0, < 4.4.0.43; >= 4.5.0, < 4.5.0.26
WSO2WSO2 Identity Server>= 5.10.0, < 5.10.0.373; >= 5.11.0, < 5.11.0.417; >= 6.0.0, < 6.0.0.247; >= 6.1.0, < 6.1.0.246; >= 7.0.0, < 7.0.0.122; >= 7.1.0, < 7.1.0.29
WSO2WSO2 Open Banking AM>= 2.0.0, < 2.0.0.393
WSO2WSO2 Identity Server as Key Manager>= 5.10.0, < 5.10.0.363
WSO2WSO2 Enterprise Integrator>= 6.6.0, < 6.6.0.223
WSO2WSO2 API Control Plane>= 4.5.0, < 4.5.0.27
WSO2WSO2 Universal Gateway>= 4.5.0, < 4.5.0.25
WSO2WSO2 Traffic Manager>= 4.5.0, < 4.5.0.25
WSO2org.wso2.carbon.registry:org.wso2.carbon.registry.info.ui>= 4.7.32, < 4.7.32.14; >= 4.7.35, < 4.7.35.11; >= 4.7.39, < 4.7.39.9; >= 4.7.51, < 4.7.51.4; >= 4.8.3, < 4.8.3.9; >= 4.8.13, < 4.8.13.6; >= 4.8.32, < 4.8.32.3; >= 4.8.36, < 4.8.36.1; >= 4.8.43, < 4.8.43.1
WSO2org.wso2.carbon.registry:org.wso2.carbon.registry.resource.ui>= 4.7.24, < 4.7.24.7; >= 4.7.32, < 4.7.32.14; >= 4.7.33, < 4.7.33.13; >= 4.7.35, < 4.7.35.11; >= 4.7.39, < 4.7.39.9; >= 4.7.51, < 4.7.51.4; >= 4.8.3, < 4.8.3.9; >= 4.8.9, < 4.8.9.5; >= 4.8.12, < 4.8.12.5; >= 4.8.13, < 4.8.13.6; >= 4.8.24, < 4.8.24.3; >= 4.8.32, < 4.8.32.3; >= 4.8.36, < 4.8.36.1; >= 4.8.43, < 4.8.43.1
WSO2org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.ui>= 4.8.19, < 4.8.19.5; >= 4.8.21, < 4.8.21.9; >= 4.8.28, < 4.8.28.3; >= 4.8.30, < 4.8.30.3; >= 4.8.32, < 4.8.32.1; >= 4.8.33, < 4.8.33.3; >= 4.8.34, < 4.8.34.3; >= 4.8.35, <= *
WSO2org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.ui>= 6.4.2, < 6.4.2.165; >= 6.4.111, < 6.4.111.155; >= 6.4.176, < 6.4.176.28; >= 6.4.180, < 6.4.180.12; >= 6.9.6, < 6.9.6.26; >= 6.13.16, < 6.13.16.19; >= 6.13.19, < 6.13.19.12; >= 6.13.27, < 6.13.27.5

References

Timeline

Published
Nov 5, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-108548.1The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent pathCVE-2025-108557.5Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of TrustCVE-2025-108568.1Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content InjectionCVE-2025-108579.8A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the fCVE-2025-108587.5An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unautheCVE-2025-108594.0Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from privateCVE-2025-10865.3A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown CVE-2025-108617.5The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable toCVE-2025-108627.5The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable toCVE-2025-108657.8Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to caCVE-2025-108676.5An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 thatCVE-2025-108685.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 wher