{"action":"Upgrade org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api to 9.31.117 or later.","affected":[{"fixed":"9.31.117","introduced":"0"}],"component":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api","cve_ids":["CVE-2025-4760"],"ecosystem":"Maven","epss":0.00188,"exploited":false,"fixed_versions":["9.31.117"],"ghsa_id":"GHSA-cmjc-qp7j-xgwr","id":"tcs_01M5N8SQ6CVNKS06GGVJAM1A3W","modified_at":"2025-09-27T04:14:05.627299Z","published_at":"2025-09-23T15:31:09Z","references":["https://osv.dev/vulnerability/GHSA-cmjc-qp7j-xgwr","https://nvd.nist.gov/vuln/detail/CVE-2025-4760","https://github.com/wso2/carbon-apimgt/pull/13099","https://github.com/wso2/carbon-apimgt/commit/1b3496c072ec68aaaf726996e2caa76f07c1adca","https://github.com/wso2/carbon-apimgt","https://mvnrepository.com/artifact/org.wso2.carbon.apimgt/org.wso2.carbon.apimgt.api/9.31.117","https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-cmjc-qp7j-xgwr","url":"https://osv.dev/vulnerability/GHSA-cmjc-qp7j-xgwr"}],"summary":"WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability"}