CVE-2025-6508

published 2026-08-06

CVE-2025-6508: The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API…

Priority P4 24 medium 4.3 CVSS 3.1

AV N AC L PR N UI R S U C N I L A N

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal.

By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.212	4.1.0.212
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.183	4.2.0.183

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79