CVE-2025-29157

An issue in petstore v.1.0.7 allows a remote attacker to achieve arbitrary code execution by accessing a non-existent /cart endpoint. The server responds with a 404-error page that exposes sensitive information, specifically the Servlet name (default) and the server version . At this time, there ...

CVE-2025-29156

A Cross-Site Scripting (XSS) vulnerability exists in petstore version 1.0.7 due to the /api/v3/pet interface failing to validate specially crafted scripts. A remote attacker can exploit this by submitting a malicious script to the endpoint, potentially leading to the execution of arbitrary code. ...

CVE-2025-29155

A security vulnerability exists in petstore v.1.0.7 , specifically within the DELETE endpoint (identified as '/DELETE' ). The root cause is the improper validation of input , which allows a remote attacker to achieve remote code execution (RCE). This is classified as CWE-77 (Improper Neutralizati...