4335 matches found
CVE-2025-49150 Cursor Agent Potentially Leaks Information using JSON schema
Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent...
CVE-2025-49150
Cursor is vulnerable prior to version 0.51.0 due to json.schemaDownload.enable being True by default. When a JSON file is written, an attacker can trigger an arbitrary HTTP GET request without user confirmation, and because the Cursor Agent can edit JSON files, this can enable data exfiltration i...
PT-2025-25236 · Cursor · Cursor
Name of the Vulnerable Software and Affected Versions: Cursor versions prior to 0.51.0 Description: The issue allows an attacker to trigger an arbitrary HTTP GET request without user confirmation by writing a JSON file. This could potentially be used to exfiltrate data if a malicious agent gains...
PT-2025-26514 · Crates.Io · Hurl
Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...
VulnCheck KEV: CVE-2022-28363
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability XSS in the /goform/loginprocess username parameter via GET. No authentication is required...
CVE-2025-48046
An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint...
CVE-2025-48046
An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint...
CVE-2025-48045
An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials...
CVE-2025-48046
CVE-2025-48046 involves an authenticated user disclosing the cleartext password of a configured SMTP server via an HTTP GET to /config.php. The connected Red Hat entries describe the vulnerability as an authenticated-access issue that exposes SMTP credentials through the /config.php endpoint. The...
CVE-2025-48046 MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext
An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint...
CVE-2025-48045 MICI Network Co. Ltd. NetFax Server Default Administrator Credentials Disclosure
An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials...
PT-2025-23150
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the "/config.php" endpoint. Recommendations At the moment, there is no...
CVE-2025-45529
An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor...
CVE-2025-45529: Files or Directories Accessible to External Parties
An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor...
CVE-2025-45529
An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor...
CVE-2025-45529
An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor...
PT-2025-23022 · Sscms · Sscms
Name of the Vulnerable Software and Affected Versions: SSCMS version 7.3.1 Description: The issue allows attackers to read arbitrary files by sending a crafted GET request to the "/cms/templates/templatesAssetsEditor" API endpoint, exploiting a flaw in the ReadTextAsynchronous function...
CVE-2025-45529
The SSCMS (SiteServerCMS) content management system, specifically version v7.3.1 , contains an arbitrary file read vulnerability. The flaw resides in the ReadTextAsynchronous function and can be exploited by sending a crafted GET request to the /cms/templates/templatesAssetsEditor API endpoint. T...
CVE-2025-0339
A vulnerability classified as problematic has been found in code-projects Online Bike Rental 1.0. Affected is an unknown function of the file /vehical-details.php of the component HTTP GET Request Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...