{"id":"CVE-2025-6623","revision":"9b0ce116402c4fb4a1fdac9a4c052a3e","records":[{"revision":"9b0ce116402c4fb4a1fdac9a4c052a3e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-6623","aliases":[],"title":"Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection","description":"The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.\n\nSuccessful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.","state":0,"publishedAt":"2026-10-19T16:25:50.419+00:00","modifiedAt":"2026-10-20T19:29:07.389+00:00","affected":[{"ecosystem":"Vendor product","name":"WSO2 API Manager","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"WSO2\",\n \"product\": \"WSO2 API Manager\",\n \"versions\": [\n {\n \"status\": \"unknown\",\n \"version\": \"0\",\n \"lessThan\": \"3.2.0\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"3.2.0\",\n \"lessThan\": \"3.2.0.433\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"3.2.1\",\n \"lessThan\": \"3.2.1.53\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"4.1.0\",\n \"lessThan\": \"4.1.0.215\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"4.2.0\",\n \"lessThan\": \"4.2.0.153\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"4.3.0\",\n \"lessThan\": \"4.3.0.66\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"4.4.0\",\n \"lessThan\": \"4.4.0.29\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"4.5.0\",\n \"lessThan\": \"4.5.0.11\",\n \"versionType\": \"custom\"\n }\n ],\n \"defaultStatus\": \"unaffected\"\n }"},{"ecosystem":"Vendor product","name":"WSO2 Universal Gateway","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"WSO2\",\n \"product\": \"WSO2 Universal Gateway\",\n \"versions\": [\n {\n \"status\": \"unknown\",\n \"version\": \"0\",\n \"lessThan\": \"4.5.0\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"4.5.0\",\n \"lessThan\": \"4.5.0.11\",\n \"versionType\": \"custom\"\n }\n ],\n \"defaultStatus\": \"unaffected\"\n }"},{"ecosystem":"Vendor product","name":"WSO2 Traffic Manager","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"WSO2\",\n \"product\": \"WSO2 Traffic Manager\",\n \"versions\": [\n {\n \"status\": \"unknown\",\n \"version\": \"0\",\n \"lessThan\": \"4.5.0\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"4.5.0\",\n \"lessThan\": \"4.5.0.11\",\n \"versionType\": \"custom\"\n }\n ],\n \"defaultStatus\": \"unaffected\"\n }"},{"ecosystem":"Vendor product","name":"WSO2 API Control Plane","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"WSO2\",\n \"product\": \"WSO2 API Control Plane\",\n \"versions\": [\n {\n \"status\": \"unknown\",\n \"version\": \"0\",\n \"lessThan\": \"4.5.0\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"4.5.0\",\n \"lessThan\": \"4.5.0.12\",\n \"versionType\": \"custom\"\n }\n ],\n \"defaultStatus\": \"unaffected\"\n }"},{"ecosystem":"Vendor product","name":"org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"WSO2\",\n \"product\": \"WSO2 Carbon Event Publisher UI\",\n \"packageName\": \"org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui\",\n \"versions\": [\n {\n \"status\": \"affected\",\n \"version\": \"5.2.26\",\n \"lessThan\": \"5.2.26.19\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.2.41\",\n \"lessThan\": \"5.2.41.6\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.2.57\",\n \"lessThan\": \"5.2.57.7\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.3.5\",\n \"lessThan\": \"5.3.5.4\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.3.11\",\n \"lessThan\": \"5.3.11.4\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.3.15\",\n \"lessThan\": \"5.3.15.3\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.3.20\",\n \"lessThan\": \"5.3.20.1\",\n \"versionType\": \"custom\"\n }\n ],\n \"defaultStatus\": \"unknown\"\n }"},{"ecosystem":"Vendor product","name":"org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"WSO2\",\n \"product\": \"WSO2 Carbon Event Receiver UI\",\n \"packageName\": \"org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui\",\n \"versions\": [\n {\n \"status\": \"affected\",\n \"version\": \"5.2.26\",\n \"lessThan\": \"5.2.26.19\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.2.41\",\n \"lessThan\": \"5.2.41.6\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.2.57\",\n \"lessThan\": \"5.2.57.7\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.3.5\",\n \"lessThan\": \"5.3.5.4\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.3.11\",\n \"lessThan\": \"5.3.11.4\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.3.15\",\n \"lessThan\": \"5.3.15.3\",\n \"versionType\": \"custom\"\n },\n {\n \"status\": \"affected\",\n \"version\": \"5.3.20\",\n \"lessThan\": \"5.3.20.1\",\n \"versionType\": \"custom\"\n }\n ],\n \"defaultStatus\": \"unknown\"\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/","https://github.com/wso2/carbon-analytics-common/pull/870"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-6623","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-6623","identifiers":["CVE-2025-6623"]},"retained":false,"historicalAffected":[]}],"coverage":[]}