The Management Console in WSO2 API Manager up to and including 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.
wso2 api manager
wso2 api microgateway 2.2.0