Category - API Security Blog

Tools for Humanity: Unlock underage blocked app without support interaction using airplane mode

The vulnerability allowed users to bypass the support requirement to unlock their blocked accounts in the iOS app. By changing the date of birth to an underage value, the app would lock the account an ...

July 17, 2025

curl: Memory Leak

Vulnerability description not...Read More ...

July 17, 2025

Mars: [XSS] Reflected XSS via POST request in (███████)

A reflected Cross-Site Scripting (XSS) vulnerability was identified in the celular parameter of a POST request to the homepage of a Mars-owned website. The vulnerability was classified as medium sever ...

July 17, 2025

curl: `Curl_socketpair()` fallback vulnerable to man-in-the-middle attack

Vulnerability description not...Read More ...

July 17, 2025

curl: CVE-2025-4947: QUIC certificate check skip with wolfSSL

Vulnerability description not...Read More ...

July 17, 2025

curl: CVE-2025-5025: No QUIC certificate pinning with wolfSSL

Vulnerability description not...Read More ...

July 17, 2025

Mozilla: IDOR: Account Deletion via Session Misbinding – Attacker Can Delete Victim Account

A critical vulnerability was identified in the Firefox Accounts API that allowed an authenticated attacker to permanently delete any user's account by sending a POST /v1/account/destroy request u ...

July 17, 2025

curl: Memory Leak in libcurl via Location Header Handling (CWE-770)

Vulnerability description not...Read More ...

July 17, 2025