CVE-2026-2445: The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the…

PriorityP429medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.25%

15.7th percentile

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.56	4.5.0.56
wso2	api_control_plane	>= 4.6.0 < 4.6.0.20	4.6.0.20
wso2	api_manager	>= 4.2.0 < 4.2.0.195	4.2.0.195
wso2	api_manager	>= 4.3.0 < 4.3.0.106	4.3.0.106
wso2	api_manager	>= 4.4.0 < 4.4.0.70	4.4.0.70
wso2	api_manager	>= 4.5.0 < 4.5.0.55	4.5.0.55
wso2	api_manager	>= 4.6.0 < 4.6.0.19	4.6.0.19
wso2	identity_server	>= 6.0.0 < 6.0.0.263	6.0.0.263
wso2	identity_server	>= 6.1.0 < 6.1.0.266	6.1.0.266
wso2	identity_server	>= 7.0.0 < 7.0.0.144	7.0.0.144
wso2	identity_server	>= 7.1.0 < 7.1.0.53	7.1.0.53
wso2	identity_server	>= 7.2.0 < 7.2.0.12	7.2.0.12
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.56	4.5.0.56
wso2	wso2_api_control_plane	>= 4.6.0 < 4.6.0.20	4.6.0.20
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.195	4.2.0.195
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.106	4.3.0.106
wso2	wso2_api_manager	>= 4.4.0 < 4.4.0.70	4.4.0.70
wso2	wso2_api_manager	>= 4.5.0 < 4.5.0.55	4.5.0.55
wso2	wso2_api_manager	>= 4.6.0 < 4.6.0.19	4.6.0.19
wso2	wso2_identity_server	>= 6.0.0 < 6.0.0.263	6.0.0.263
wso2	wso2_identity_server	>= 6.1.0 < 6.1.0.266	6.1.0.266
wso2	wso2_identity_server	>= 7.0.0 < 7.0.0.144	7.0.0.144
wso2	wso2_identity_server	>= 7.1.0 < 7.1.0.53	7.1.0.53
wso2	wso2_identity_server	>= 7.2.0 < 7.2.0.12	7.2.0.12

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.