Shellfeel

**Name of the Vulnerable Software and Affected Versions** rymcu forest version 0.02 **Description** An issue in the software allows a remote attacker to obtain sensitive information via manipulation of the HTTP body URL in the com.rymcu.forest.web.api.common.UploadController file. **Recommendations** For version 0.02, consider restricting access to the UploadController file to minimize the risk of exploitation. As a temporary workaround, avoid using the UploadController file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TDuckCLoud tduck-platform version 4.0 **Description** The issue allows a remote attacker to obtain sensitive information via the `getFormKey` parameter in the search function of the FormDataMysqlService.java file. This is a SQL Injection vulnerability. **Recommendations** For TDuckCLoud tduck-platform version 4.0, consider restricting access to the `getFormKey` parameter in the search function of the FormDataMysqlService.java file until a patch is available. As a temporary workaround, avoid using the `getFormKey` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.