CVE-2025-8591: The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition…

PriorityP428medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.25%

15.7th percentile

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking.

Affected

48 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.44	4.5.0.44
wso2	api_control_plane	>= 4.6.0 < 4.6.0.8	4.6.0.8
wso2	api_manager	>= 3.1.0 < 3.1.0.355	3.1.0.355
wso2	api_manager	>= 3.2.0 < 3.2.0.459	3.2.0.459
wso2	api_manager	>= 3.2.1 < 3.2.1.78	3.2.1.78
wso2	api_manager	>= 4.0.0 < 4.0.0.380	4.0.0.380
wso2	api_manager	>= 4.1.0 < 4.1.0.243	4.1.0.243
wso2	api_manager	>= 4.2.0 < 4.2.0.183	4.2.0.183
wso2	api_manager	>= 4.3.0 < 4.3.0.94	4.3.0.94
wso2	api_manager	>= 4.4.0 < 4.4.0.58	4.4.0.58
wso2	api_manager	>= 4.5.0 < 4.5.0.43	4.5.0.43
wso2	api_manager	>= 4.6.0 < 4.6.0.7	4.6.0.7
wso2	identity_server	>= 5.10.0 < 5.10.0.384	5.10.0.384
wso2	identity_server	>= 6.0.0 < 6.0.0.255	6.0.0.255
wso2	identity_server	>= 7.0.0 < 7.0.0.131	7.0.0.131
wso2	identity_server	>= 7.1.0 < 7.1.0.51	7.1.0.51
wso2	identity_server_as_key_manager	>= 5.10.0 < 5.10.0.375	5.10.0.375
wso2	open_banking_am	>= 2.0.0 < 2.0.0.404	2.0.0.404
wso2	open_banking_iam	>= 2.0.0 < 2.0.0.424	2.0.0.424
wso2	traffic_manager	>= 4.5.0 < 4.5.0.42	4.5.0.42
wso2	traffic_manager	>= 4.6.0 < 4.6.0.7	4.6.0.7
wso2	universal_gateway	>= 4.5.0 < 4.5.0.42	4.5.0.42
wso2	universal_gateway	>= 4.6.0 < 4.6.0.7	4.6.0.7
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.44	4.5.0.44
wso2	wso2_api_control_plane	>= 4.6.0 < 4.6.0.8	4.6.0.8

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.