CVE-2024-11994 APM Server Insertion of Sensitive Information into Log File

APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document, this could disclose sensitive information in APM Server error logs...

CVE-2025-28009

A SQL Injection vulnerability exists in the u parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20...

Biting the CHERI Bullet: Blockers, Enablers and Security Implications of CHERI in Defence

There is growing interest in securing the hardware foundations software stacks build upon. However, before making any investment decision, software and hardware supply chain stakeholders require evidence from realistic, multiple long-term studies of adoption. We present results from a 12 month...

CVE-2025-42602: Insufficient Session Expiration

This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A remote attacker could exploit this vulnerability by intercepting and manipulating the responses through API request body leading to...

CVE-2025-28009

A SQL Injection vulnerability exists in the u parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20...

CVE-2025-28009

A SQL Injection vulnerability exists in the u parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20...

PT-2025-17222 · Unknown · Dietiqa App

Name of the Vulnerable Software and Affected Versions: Dietiqa App version 1.0.20 Description: A SQL Injection issue exists in the u parameter of the "progress-body-weight.php" endpoint. Recommendations: For Dietiqa App version 1.0.20, avoid using the u parameter in the "progress-body-weight.php"...

CVE-2025-28009: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in the u parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20...

CVE-2025-28009

A SQL Injection vulnerability exists in the Dietiqa App v1.0.20 (by Appventure Sdn Bhd). The flaw is located in the u parameter of the progress-body-weight.php endpoint due to unsanitized input , which allows an unauthenticated remote attacker to inject arbitrary SQL queries into the backend data...

CVE-2025-28009

A SQL Injection vulnerability exists in the u parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20...

Belanjawan Dietiqa 安全漏洞

Belanjawan Dietiqa is a mobile weight loss application from Belanjawan. A security vulnerability exists in Belanjawan Dietiqa version 1.0.20, which stems from improper handling of parameter u in the progress-body-weight.php endpoint, which could lead to SQL injection...

Always-Incorrect Control Flow Implementation

Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation in the fixRequestBody function. An attacker can cause writeBody to be called multiple times, leading to unexpected behavior. Remediation A fix was pushed into the master branch but not yet...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the fixRequestBody function, which processes certain invalid requests without error. An attacker can manipulate the request body by sending requests that violate the expected...

GHSA-9GQV-WP59-FQ42 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32997

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

CVE-2025-32997

In CVE-2025-32997, the http-proxy-middleware has a flaw where fixRequestBody proceeds even if bodyParser has failed, affecting versions: 2.0.7/2.0.8 (before 2.0.9) and 3.x before 3.0.5. The Connected IBM bulletin confirms the root cause and lists remediation: upgrade to http-proxy-middleware v2.0...

SUSE CVE-2013-1087

Cross-site scripting XSS vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML via the body of an e-mail message...

CVE-2024-6857

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-6857: Cross-Site Request Forgery (CSRF)

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

PYSEC-2025-229

A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctionBody of the file src/interp/binary-reader-interp.cc. The manipulation leads to null pointer dereference. The attack can be launched...