# Wso2 Identity Server


- [CVE-2022-29464](https://insights.sbomify.com/CVE-2022-29464/): WSO2 Multiple Products Unrestrictive Upload of File (critical 9.8, exploited in the wild)
- [CVE-2025-9312](https://insights.sbomify.com/CVE-2025-9312/): Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products (critical 9.8)
- [CVE-2025-10611](https://insights.sbomify.com/CVE-2025-10611/): Potential Broken Access Control in Multiple WSO2 Products via System REST APIs (critical 9.8)
- [CVE-2024-6914](https://insights.sbomify.com/CVE-2024-6914/): Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover (critical 9.8)
- [CVE-2025-9804](https://insights.sbomify.com/CVE-2025-9804/): Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs (critical 9.6)
- [CVE-2025-15039](https://insights.sbomify.com/CVE-2025-15039/): Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products (critical 9.4)
- [CVE-2021-42646](https://insights.sbomify.com/CVE-2021-42646/): XML external entity in n/a (critical 9.1)
- [CVE-2025-6670](https://insights.sbomify.com/CVE-2025-6670/): Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services (high 8.8)
- [CVE-2020-24703](https://insights.sbomify.com/CVE-2020-24703/): Open redirect in n/a (high 8.8)
- [CVE-2020-24705](https://insights.sbomify.com/CVE-2020-24705/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2016-4311](https://insights.sbomify.com/CVE-2016-4311/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2020-12719](https://insights.sbomify.com/CVE-2020-12719/): XML external entity in n/a (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/products/wso2/identity-server/