3466 matches found
CVE-2025-34044
A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands. Exploitation eviden...
The vulnerability of the sub_415EF8 function in Netgear EX6100 router microprogramming software allows a hacker to execute arbitrary code.
The vulnerability of sub415EF8 in Netgear EX6100 router microprogramming software relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted GET request...
CVE-2023-47030
An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a UserService SOAP API endpoint to validate if a user exists...
CVE-2025-40726
Reflected Cross-Site Scripting XSS vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GET request parameter...
CVE-2025-40726 Cross-Site Scripting (XSS) reflected in Nosto
Reflected Cross-Site Scripting XSS vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GET request parameter...
CVE-2025-40726
CVE-2025-40726 is a reflected XSS vulnerability in Nosto exposed on the /pages/search-results-page endpoint. The issue allows an attacker to trigger arbitrary code execution via the q GET parameter. The CVSS base score is 5.1 (Medium); attack vector is network, with low attack complexity, no priv...
CVE-2025-49150
Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent...
CVE-2024-34711
GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. By default, GeoServer use...
CVE-2025-46035
Buffer Overflow vulnerability in Tenda AC6 v.15.03.05.16 allows a remote attacker to cause a denial of service via the oversized schedStartTime and schedEndTime parameters in an unauthenticated HTTP GET request to the /goform/openSchedWifi endpoint...
CVE-2025-46035
CVE-2025-46035 outlines a buffer overflow in the Tenda AC6 router (v15.03.05.16) triggered by oversized schedStartTime and schedEndTime values in an unauthenticated HTTP GET to /goform/openSchedWifi, leading to a denial of service. Affected product is Tenda AC6; the issue stems from inadequate in...
CVE-2025-49150
Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent...
CVE-2025-49150 Cursor Agent Potentially Leaks Information using JSON schema
Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent...
CVE-2025-49150 Cursor Agent Potentially Leaks Information using JSON schema
Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent...
CVE-2025-49150
Cursor is vulnerable prior to version 0.51.0 due to json.schemaDownload.enable being True by default. When a JSON file is written, an attacker can trigger an arbitrary HTTP GET request without user confirmation, and because the Cursor Agent can edit JSON files, this can enable data exfiltration i...
PT-2025-25236 · Cursor · Cursor
Name of the Vulnerable Software and Affected Versions: Cursor versions prior to 0.51.0 Description: The issue allows an attacker to trigger an arbitrary HTTP GET request without user confirmation by writing a JSON file. This could potentially be used to exfiltrate data if a malicious agent gains...
PT-2025-26514 · Crates.Io · Hurl
Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...
VulnCheck KEV: CVE-2022-28363
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability XSS in the /goform/loginprocess username parameter via GET. No authentication is required...
CVE-2025-48046
An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint...