CVE-2025-29157 | Medium | 6.5 | 2025-09-25 | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page… |
CVE-2025-29156 | Medium | 6.1 | 2025-09-25 | Cross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/pet |
CVE-2025-29155 | Medium | 6.5 | 2025-09-25 | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint |
CVE-2024-7565 | High | 7.8 | 2024-11-22 | SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-22207 | Medium | 5.3 | 2024-01-15 | fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will l… |
CVE-2023-22892 | High | 7.5 | 2023-03-08 | There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arb… |
CVE-2023-22891 | High | 8.1 | 2023-03-08 | There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords… |
CVE-2023-22890 | High | 7.5 | 2023-03-08 | SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, causing a denial of s… |
CVE-2023-22889 | Critical | 9.8 | 2023-03-08 | SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. This could lead to remote code execution by unauthenticated… |
CVE-2021-46708 | Medium | 6.1 | 2022-03-11 | The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit… |
CVE-2018-25031 | Medium | 4.3 | 2022-03-11 | Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit… |
CVE-2021-41657 | Medium | 6.1 | 2022-03-10 | SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack. |
CVE-2021-21364 | Medium | 5.3 | 2021-03-11 | swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different language… |
CVE-2021-21363 | Medium | 5.3 | 2021-03-11 | swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different language… |
CVE-2020-26118 | High | 8.8 | 2021-01-11 | In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerabilit… |
CVE-2020-12835 | Critical | 9.8 | 2020-05-20 | An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inj… |
CVE-2019-12180 | High | 7.8 | 2020-02-05 | An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically… |
CVE-2016-1000229 | Medium | 6.1 | 2019-12-20 | swagger-ui has XSS in key names |
CVE-2019-17495 | Critical | 9.8 | 2019-10-10 | A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perf… |
CVE-2018-20580 | High | 8.8 | 2019-05-03 | The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a… |
CVE-2017-16670 | High | 7.8 | 2018-02-19 | The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file. |
CVE-2016-5682 | Medium | 6.1 | 2017-04-10 | Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section. |
CVE-2014-1202 | | | 2014-01-25 | The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file. |