hoverfly records

3 published records for vendor hoverfly.

Researcher profile

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

3 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
47Plan	CVE-2024-45388Proof of concept	Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)hoverfly · hoverfly · CWE-200 Pre-auth Info leak	High7.5	—	55.6%	Sep 2, 2024
42Plan	CVE-2025-54123Proof of concept	Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementationhoverfly · hoverfly · CWE-20 pre-auth RCE Command injection	Critical9.8	—	10.5%	Sep 10, 2025
31Monitor	CVE-2025-54376No exploit	Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.hoverfly · hoverfly · CWE-200 Pre-auth Auth bypass Info leak	High7.8	—	0.7%	Sep 10, 2025

CVE-2024-45388
47Plan
Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)
HighCVSS 7.5Proof of conceptEPSS 56%
- Pre-auth
- Info leak
hoverfly · hoverflySep 2, 2024
CVE-2025-54123
42Plan
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
CriticalCVSS 9.8Proof of conceptEPSS 11%
- pre-auth RCE
- Command injection
hoverfly · hoverflySep 10, 2025
CVE-2025-54376
31Monitor
Hoverfly's WebSocket endpoint `/api/v2/ws/logs` reachable without authentication even when --auth is enabled.
HighCVSS 7.8No exploitEPSS 1%
hoverfly · hoverflySep 10, 2025