CVE-2025-10853
Last modified
CVE-2025-10853 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wso2 | Api Control Plane | 4.5.0 |
| Wso2 | Api Manager | 3.1.0 |
| Wso2 | Api Manager | 3.2.0 |
| Wso2 | Api Manager | 3.2.1 |
| Wso2 | Api Manager | 4.0.0 |
| Wso2 | Api Manager | 4.1.0 |
| Wso2 | Api Manager | 4.2.0 |
| Wso2 | Api Manager | 4.3.0 |
| Wso2 | Api Manager | 4.4.0 |
| Wso2 | Api Manager | 4.5.0 |
| Wso2 | Enterprise Integrator | 6.6.0 |
| Wso2 | Identity Server | 5.10.0 |
| Wso2 | Identity Server | 5.11.0 |
| Wso2 | Identity Server | 6.0.0 |
| Wso2 | Identity Server | 6.1.0 |
| Wso2 | Identity Server | 7.0.0 |
| Wso2 | Identity Server | 7.1.0 |
| Wso2 | Identity Server As Key Manager | 5.10.0 |
| Wso2 | Open Banking Am | 2.0.0 |
| Wso2 | Open Banking Iam | 2.0.0 |
| Wso2 | Traffic Manager | 4.5.0 |
| Wso2 | Universal Gateway | 4.5.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-10853?
How severe is CVE-2025-10853?
How do I fix CVE-2025-10853?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-10847DX Unified Infrastructure Management (Nimsoft/UIM) and below…8.4
- CVE-2025-10848A vulnerability was identified in Campcodes Society Membersh…8.8
- CVE-2025-10849The Felan Framework plugin for WordPress is vulnerable to un…5.3
- CVE-2025-1085A vulnerability, which was classified as problematic, was fo…5.3
- CVE-2025-10850The Felan Framework plugin for WordPress is vulnerable to im…9.8
- CVE-2025-10851A security flaw has been discovered in Campcodes Gym Managem…9.8
- CVE-2025-10854The txtai framework allows the loading of compressed tar fil…8.1
- CVE-2025-10855Authorization Bypass Through User-Controlled Key vulnerabili…7.5
- CVE-2025-10856Unrestricted Upload of File with Dangerous Type vulnerabilit…8.1
- CVE-2025-10857A security flaw has been discovered in Campcodes Point of Sa…9.8
- CVE-2025-10858An issue was discovered in GitLab CE/EE affecting all versio…7.5
- CVE-2025-10859Cookie storage for non-HTML temporary documents was being sh…4
Are you affected by CVE-2025-10853?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST