6.4

CVE-2026-4103

Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed.

Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerWSO2
≫
Produkt WSO2 API Control Plane
Default Statusunaffected
Version 4.5.0
Version < 4.5.0.55
Status affected
Version 4.6.0
Version < 4.6.0.19
Status affected
HerstellerWSO2
≫
Produkt WSO2 API Manager
Default Statusunaffected
Version 0
Version < 3.2.0
Status unknown
Version 3.2.0
Version < 3.2.0.470
Status affected
Version 3.2.1
Version < 3.2.1.89
Status affected
Version 4.1.0
Version < 4.1.0.254
Status affected
Version 4.2.0
Version < 4.2.0.194
Status affected
Version 4.3.0
Version < 4.3.0.105
Status affected
Version 4.4.0
Version < 4.4.0.69
Status affected
Version 4.5.0
Version < 4.5.0.54
Status affected
Version 4.6.0
Version < 4.6.0.18
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.078
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
ed10eef1-636d-4fbe-9993-6890dfa878f8 6.4 3.1 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-4844/