Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2016-1222: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in Kobe Beauty php-contact-form before 2016-05-18 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-06-05T01:59Z
Repository: https://github.com/kobebeauty/php-contact-form
Language: PHP
Files changed: contact/confirm.php, contact/index.php
Commit date: 2016-05-18 18:30:25 +0900
Commit message: クロスサイトスクリプティングの脆弱性発覚に伴うコード一部修正

Diff: diff --git a/contact/confirm.php b/contact/confirm.php
index 0ea73db..c2dc21c 100644
--- a/contact/confirm.php
+++ b/contact/confirm.php
@@ -60,11 +60,11 @@ getHeader();
 	<p class="mb30">
 		この内容でよろしければ送信するボタンを押してください。<br>
 		メールアドレスに間違いがあると回答の返信ができませんので十分にご確認ください。
 	</p>
 
-	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo $_SERVER["PHP_SELF"]; ?>">
+	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo htmlspchar($_SERVER['PHP_SELF']); ?>">
 		<table class="table table-bordered confirm">
 			<tr>
 				<th>お名前</th>
 				<td><?php echo htmlspchar($name); ?></td>
 			</tr>
diff --git a/contact/index.php b/contact/index.php
index 02564d8..242c592 100644
--- a/contact/index.php
+++ b/contact/index.php
@@ -73,11 +73,11 @@ getHeader();
 <?php } ?>
 
 <div class="page-content">
 	<p class="mb30">以下を入力し確認するボタンを押してください。<span class="red">*</span>は入力必須です。</p>
 
-	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo $_SERVER["PHP_SELF"]; ?>" novalidate>
+	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo htmlspchar($_SERVER['PHP_SELF']); ?>" novalidate>
 		<div class="form-group">
 			<label for="inputName" class="col-sm-3 control-label">お名前<span class="red">*</span></label>
 			<div class="col-sm-9">
 				<input type="text" class="form-control" name="contact_data[name]" placeholder="お名前" value="<?php echo htmlspchar($name); ?>">
 			</div>

Vulnerable code: 	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo $_SERVER["PHP_SELF"]; ?>">
	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo $_SERVER["PHP_SELF"]; ?>" novalidate>
Fixed code: 	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo htmlspchar($_SERVER['PHP_SELF']); ?>">
	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo htmlspchar($_SERVER['PHP_SELF']); ?>" novalidate>
CVE-2022-4523: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in vexim2. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 21c0a60d12e9d587f905cd084b2c70f9b1592065. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215903.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-15T21:15Z
Repository: https://github.com/vexim/vexim2
Language: Unknown
Commit date: 2022-01-23 12:21:02 +0200
Commit message: Merge pull request #274 from rimas-kudelis/xss-prevention

Use `htmlspecialchars()` to escape user-provided vars before output
CVE-2020-22784: Incorrect Comparison (CWE-697)
value: In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names.
CWE description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CVSS v3 base score: 7.5
Published: 2021-04-28T21:15Z
Repository: https://github.com/ether/ueberDB
Language: JSON
Files changed: mysql_db.js, package.json
Commit date: 2020-04-01 18:05:33 +0000
Commit message: go go gadget mysql fix for 2877

Diff: diff --git a/mysql_db.js b/mysql_db.js
index bf19f85..806c670 100644
--- a/mysql_db.js
+++ b/mysql_db.js
@@ -127,11 +127,11 @@ exports.database.prototype.init = function(callback)
   this.schedulePing();
 }
 
 exports.database.prototype.get = function (key, callback)
 {
-  this.db.query("SELECT `value` FROM `store` WHERE  `key` = ?", [key], function(err,results)
+  this.db.query("SELECT `value` FROM `store` WHERE BINARY `key` = ?", [key], function(err,results)
   {
     var value = null;
     
     if(!err && results.length == 1)
     {
@@ -144,11 +144,11 @@ exports.database.prototype.get = function (key, callback)
   this.schedulePing();
 }
 
 exports.database.prototype.findKeys = function (key, notKey, callback)
 {
-  var query="SELECT `key` FROM `store` WHERE  `key` LIKE ?"
+  var query="SELECT `key` FROM `store` WHERE BINARY `key` LIKE ?"
     , params=[]
   ;
   
   //desired keys are key, e.g. pad:%
   key=key.replace(/\*/g,'%');
diff --git a/package.json b/package.json
index 29ee791..0045cdd 100644
--- a/package.json
+++ b/package.json
@@ -41,11 +41,11 @@
   "repository": {
     "type": "git",
     "url": "https://github.com/ether/ueberDB.git"
   },
   "main": "./CloneAndAtomicLayer",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "gitHead": "00cb8c896433922111c12fe9d2a45087fdb11d59",
   "bugs": {
     "url": "https://github.com/ether/ueberDB/issues"
   },
   "homepage": "https://github.com/ether/ueberDB",

Vulnerable code:   this.db.query("SELECT `value` FROM `store` WHERE  `key` = ?", [key], function(err,results)
  var query="SELECT `key` FROM `store` WHERE  `key` LIKE ?"
  "version": "0.4.3",
Fixed code:   this.db.query("SELECT `value` FROM `store` WHERE BINARY `key` = ?", [key], function(err,results)
  var query="SELECT `key` FROM `store` WHERE BINARY `key` LIKE ?"
  "version": "0.4.4",
CVE-2022-37032: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-09-19T22:15Z
Repository: https://github.com/FRRouting/frr
Language: C
Files changed: bgpd/bgp_packet.c
Commit date: 2022-07-22 13:56:54 -0400
Commit message: bgpd: Make sure hdr length is at a minimum of what is expected

Ensure that if the capability length specified is enough data.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>

Diff: diff --git a/bgpd/bgp_packet.c b/bgpd/bgp_packet.c
index dbf6c0b2e9..45752a8ab6 100644
--- a/bgpd/bgp_packet.c
+++ b/bgpd/bgp_packet.c
@@ -2618,10 +2618,18 @@ static int bgp_capability_msg_parse(struct peer *peer, uint8_t *pnt,
 		if (bgp_debug_neighbor_events(peer))
 			zlog_debug(
 				"%s CAPABILITY has action: %d, code: %u, length %u",
 				peer->host, action, hdr->code, hdr->length);
 
+		if (hdr->length < sizeof(struct capability_mp_data)) {
+			zlog_info(
+				"%pBP Capability structure is not properly filled out, expected at least %zu bytes but header length specified is %d",
+				peer, sizeof(struct capability_mp_data),
+				hdr->length);
+			return BGP_Stop;
+		}
+
 		/* Capability length check. */
 		if ((pnt + hdr->length + 3) > end) {
 			zlog_info("%s Capability length error", peer->host);
 			bgp_notify_send(peer, BGP_NOTIFY_CEASE,
 					BGP_NOTIFY_SUBCODE_UNSPECIFIC);

Fixed code: 		if (hdr->length < sizeof(struct capability_mp_data)) {
			zlog_info(
				"%pBP Capability structure is not properly filled out, expected at least %zu bytes but header length specified is %d",
				peer, sizeof(struct capability_mp_data),
				hdr->length);
			return BGP_Stop;
		}
CVE-2018-11627: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-05-31T19:29Z
Repository: https://github.com/sinatra/sinatra
Language: Ruby
Files changed: lib/sinatra/base.rb
Commit date: 2018-05-31 01:05:27 +0900
Commit message: escape invalid query params, fixes #1428

Diff: diff --git a/lib/sinatra/base.rb b/lib/sinatra/base.rb
index 6843b4d3..727078d8 100644
--- a/lib/sinatra/base.rb
+++ b/lib/sinatra/base.rb
@@ -76,11 +76,11 @@ module Sinatra
     end
 
     def params
       super
     rescue Rack::Utils::ParameterTypeError, Rack::Utils::InvalidParameterError => e
-      raise BadRequest, "Invalid query parameters: #{e.message}"
+      raise BadRequest, "Invalid query parameters: #{Rack::Utils.escape_html(e.message)}"
     end
 
     private
 
     class AcceptEntry

Vulnerable code:       raise BadRequest, "Invalid query parameters: #{e.message}"
Fixed code:       raise BadRequest, "Invalid query parameters: #{Rack::Utils.escape_html(e.message)}"
CVE-2018-7212: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2018-02-18T06:29Z
Repository: https://github.com/sinatra/sinatra
Language: Unknown
Commit date: 2018-02-12 23:41:07 +0900
Commit message: Merge pull request #1387 from namusyaka/update-changelog

bump versions to 2.0.1.rc1
CVE-2020-13405: Missing Authentication for Critical Function (CWE-306)
value: userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 7.5
Published: 2020-07-16T19:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: userfiles/modules/users/controller.php
Commit date: 2020-05-22 10:12:18 +0300
Commit message: update

Diff: diff --git a/userfiles/modules/users/controller.php b/userfiles/modules/users/controller.php
index 540ea8712..a4abe2daf 100644
--- a/userfiles/modules/users/controller.php
+++ b/userfiles/modules/users/controller.php
@@ -1,3 +1,2 @@
 <?php
 
-dd(User::all());
\ No newline at end of file

Vulnerable code: dd(User::all());
CVE-2021-32856: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-21T15:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Content/ContentManagerHelpers.php
Commit date: 2021-09-16 14:26:49 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Content/ContentManagerHelpers.php b/src/MicroweberPackages/Content/ContentManagerHelpers.php
index 714d0d84d4..a7cece6297 100644
--- a/src/MicroweberPackages/Content/ContentManagerHelpers.php
+++ b/src/MicroweberPackages/Content/ContentManagerHelpers.php
@@ -7,10 +7,11 @@ use ContentFields;
 use Illuminate\Support\Facades\Cache;
 use DB;
 use MicroweberPackages\Category\Models\CategoryItem;
 use MicroweberPackages\Menu\Menu;
 use MicroweberPackages\App\Http\Controllers\FrontendController;
+use voku\helper\AntiXSS;
 
 class ContentManagerHelpers extends ContentManagerCrud
 {
     public function add_content_to_menu($content_id, $menu_id = false)
     {
@@ -969,11 +970,17 @@ class ContentManagerHelpers extends ContentManagerCrud
                                     $content_id_for_con_field = intval($ref_page['id']);
                                 }
                             }
                         }
                         $html_to_save = $the_field_data['html'];
-                        $html_to_save = $content = $this->app->parser->make_tags($html_to_save);
+                        $html_to_save = $this->app->parser->make_tags($html_to_save);
+
+                        $antixss = new AntiXSS();
+                        $html_to_save = $content = $antixss->xss_clean($html_to_save);
+
+
+
 
                         if ($save_global == false and $save_layout == false) {
                             if ($content_id) {
 
                                 $for_histroy = get_content_by_id($content_id);

Vulnerable code:                         $html_to_save = $content = $this->app->parser->make_tags($html_to_save);
Fixed code: use voku\helper\AntiXSS;
                        $html_to_save = $this->app->parser->make_tags($html_to_save);

                        $antixss = new AntiXSS();
                        $html_to_save = $content = $antixss->xss_clean($html_to_save);
CVE-2022-0277: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 6.5
Published: 2022-01-20T10:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/User/helpers/api_user.php
Commit date: 2022-01-19 11:35:10 +0200
Commit message: search_authors only admins

Diff: diff --git a/src/MicroweberPackages/User/helpers/api_user.php b/src/MicroweberPackages/User/helpers/api_user.php
index 2278395c34..ad6bb9572b 100644
--- a/src/MicroweberPackages/User/helpers/api_user.php
+++ b/src/MicroweberPackages/User/helpers/api_user.php
@@ -61,13 +61,13 @@ api_expose_admin('users/forgot_password_email_send_test', function () {
         echo "Error Message: <br />" . $e->getMessage();
     }
 
 });
 
-api_expose('users/search_authors', function ($params = false) {
+api_expose_admin('users/search_authors', function ($params = false) {
 
-    $return = array();
+    $return = array(); 
 
     $kw = false;
     if (isset($params['kw'])) {
         $kw = $params['kw'];
     }

Vulnerable code: api_expose('users/search_authors', function ($params = false) {
    $return = array();
Fixed code: api_expose_admin('users/search_authors', function ($params = false) {
    $return = array();
CVE-2022-0278: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-20T10:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: userfiles/modules/admin/notifications/notif_form_entry.php
Commit date: 2022-01-19 11:56:21 +0200
Commit message: xss on contact form fix

Diff: diff --git a/userfiles/modules/admin/notifications/notif_form_entry.php b/userfiles/modules/admin/notifications/notif_form_entry.php
index 586de353b6..dc92f12cbb 100644
--- a/userfiles/modules/admin/notifications/notif_form_entry.php
+++ b/userfiles/modules/admin/notifications/notif_form_entry.php
@@ -89,11 +89,10 @@ if (isset($item['created_by'])) {
 
         <div class="collapse" id="notif-entry-item-<?php print $item_id ?>">
             <hr class="thin" />
             <div class="row">
 
-
                 <?php
                 $iformVr=0;
                 foreach ($form_values_formated as $form_values_row) {
                 ?>
                 <div class="col-md-6">
@@ -104,16 +103,16 @@ if (isset($item['created_by'])) {
                     <?php if ($form_values_row){ ?>
                         <?php foreach ($form_values_row as $key => $val1){ ?>
                             <?php if (!is_array($val1)){ ?>
                                 <div>
                                     <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>
-                                    <p><?php print $val1; ?></p>
+                                    <p><?php print htmlentities($val1); ?></p>
                                 </div>
                             <?php } else { ?>
                                 <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>
                                 <?php foreach ($val1 as $val1_1){ ?>
-                                    <p><?php print $val1_1 . '<br />'; ?></p>
+                                    <p><?php print htmlentities($val1_1) . '<br />'; ?></p>
                                 <?php }?>
                             <?php } ?>
                         <?php } ?>
                         <?php } ?>
 

Vulnerable code: 
                                    <p><?php print $val1; ?></p>
                                    <p><?php print $val1_1 . '<br />'; ?></p>
Fixed code:                                     <p><?php print htmlentities($val1); ?></p>
                                    <p><?php print htmlentities($val1_1) . '<br />'; ?></p>
CVE-2022-0281: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2022-01-20T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/User/helpers/api_user.php
Commit date: 2022-01-19 11:35:10 +0200
Commit message: search_authors only admins

Diff: diff --git a/src/MicroweberPackages/User/helpers/api_user.php b/src/MicroweberPackages/User/helpers/api_user.php
index 2278395c34..ad6bb9572b 100644
--- a/src/MicroweberPackages/User/helpers/api_user.php
+++ b/src/MicroweberPackages/User/helpers/api_user.php
@@ -61,13 +61,13 @@ api_expose_admin('users/forgot_password_email_send_test', function () {
         echo "Error Message: <br />" . $e->getMessage();
     }
 
 });
 
-api_expose('users/search_authors', function ($params = false) {
+api_expose_admin('users/search_authors', function ($params = false) {
 
-    $return = array();
+    $return = array(); 
 
     $kw = false;
     if (isset($params['kw'])) {
         $kw = $params['kw'];
     }

Vulnerable code: api_expose('users/search_authors', function ($params = false) {
    $return = array();
Fixed code: api_expose_admin('users/search_authors', function ($params = false) {
    $return = array();
CVE-2022-0378: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-26T16:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/Http/Controllers/ApiController.php
Commit date: 2022-01-19 12:33:18 +0200
Commit message: fix xss on module api call in value parameters

Diff: diff --git a/src/MicroweberPackages/App/Http/Controllers/ApiController.php b/src/MicroweberPackages/App/Http/Controllers/ApiController.php
index 7973615d77..6d628263d5 100644
--- a/src/MicroweberPackages/App/Http/Controllers/ApiController.php
+++ b/src/MicroweberPackages/App/Http/Controllers/ApiController.php
@@ -15,13 +15,10 @@ use voku\helper\AntiXSS;
 
 
 class ApiController  extends FrontendController
 {
 
-
-
-
     public function api_html()
     {
         if (!defined('MW_API_HTML_OUTPUT')) {
             define('MW_API_HTML_OUTPUT', true);
         }
@@ -607,24 +604,27 @@ class ApiController  extends FrontendController
         }
 
 
         $request_data = array_merge($_GET, $_POST);
 
-
         // sanitize attributes
         if($request_data){
             $request_data_new = [];
             $antixss = new AntiXSS();
             foreach ($request_data as $k=>$v){
+
+                $v = $antixss->xss_clean($v);
+
                 if(is_string($k)){
                     $k = $antixss->xss_clean($k);
                     if($k){
                         $request_data_new[$k] = $v;
                     }
                 } else {
                     $request_data_new[$k] = $v;
                 }
+                
             }
             $request_data = $request_data_new;
         }
 
         $page = false;

Fixed code: 
                $v = $antixss->xss_clean($v);
CVE-2022-0379: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-26T16:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Checkout/Http/Middleware/CheckoutV2.php, src/MicroweberPackages/Checkout/routes/web.php
Commit date: 2022-01-26 12:32:55 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Checkout/Http/Middleware/CheckoutV2.php b/src/MicroweberPackages/Checkout/Http/Middleware/CheckoutV2.php
index ff346a5d59b..1dbdf59425e 100644
--- a/src/MicroweberPackages/Checkout/Http/Middleware/CheckoutV2.php
+++ b/src/MicroweberPackages/Checkout/Http/Middleware/CheckoutV2.php
@@ -13,11 +13,10 @@ class CheckoutV2
      * @param \Closure $next
      * @return mixed
      */
     public function handle($request, Closure $next)
     {
-
         $checkCart = cart_get_items_count();
 
         if (!$checkCart) {
             //$shop_page = get_content('single=true&content_type=page&is_shop=1');
             $shop_page = app()->content_repository->getFirstShopPage();
diff --git a/src/MicroweberPackages/Checkout/routes/web.php b/src/MicroweberPackages/Checkout/routes/web.php
index 29b45c4eaca..0bbf7854e7d 100644
--- a/src/MicroweberPackages/Checkout/routes/web.php
+++ b/src/MicroweberPackages/Checkout/routes/web.php
@@ -1,11 +1,15 @@
 <?php
 
 // Private
 Route::name('checkout.')
    // ->prefix(multilanguage_route_prefix('checkout'))
-    ->middleware([\MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class, \MicroweberPackages\Checkout\Http\Middleware\CheckoutV2::class])
+    ->middleware([
+        \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
+       \MicroweberPackages\Checkout\Http\Middleware\CheckoutV2::class,
+       \MicroweberPackages\App\Http\Middleware\XSS::class
+   ])
     ->namespace('\MicroweberPackages\Checkout\Http\Controllers')
     ->group(function () {
 
         // Contact info
         Route::get('cart', 'CheckoutController@index')->name('cart');

Vulnerable code: 
    ->middleware([\MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class, \MicroweberPackages\Checkout\Http\Middleware\CheckoutV2::class])
Fixed code:     ->middleware([
        \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
       \MicroweberPackages\Checkout\Http\Middleware\CheckoutV2::class,
       \MicroweberPackages\App\Http\Middleware\XSS::class
   ])
CVE-2022-0504: Generation of Error Message Containing Sensitive Information (CWE-209)
value: Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 6.5
Published: 2022-02-08T09:15Z
Repository: https://github.com/microweber/microweber
Language: JavaScript
Files changed: userfiles/modules/admin/backup/js/restore.js, userfiles/modules/microweber/api/api.js
Commit date: 2022-02-03 14:39:28 +0200
Commit message: update

Diff: diff --git a/userfiles/modules/admin/backup/js/restore.js b/userfiles/modules/admin/backup/js/restore.js
index 88aef9962b0..90096f27b3a 100644
--- a/userfiles/modules/admin/backup/js/restore.js
+++ b/userfiles/modules/admin/backup/js/restore.js
@@ -152,10 +152,14 @@ mw.restore = {
 				$('#mw_backup_import_modal').find('.backup-import-modal-log').before('<h3>Error!</h3><br />' + json_data.error);
 				return;
 			}
 
 			if (json_data.done) {
+
+                mw.restore.reload_mw_db();
+                mw.clear_cache();
+
 				mw.restore.get_progress(100);
 				mw.restore.get_log_check('stop');
 				//mw.spinner({element: ".button-start", size: 30, color: 'white'}).hide()
 				$('.button-start').removeClass('disabled');
 
@@ -175,10 +179,15 @@ mw.restore = {
 			}
 		  }
 		});
 	},
 
+    reload_mw_db: function () {
+        $.post(mw.settings.api_url + 'mw_post_update');
+        mw.notification.success("The DB was reloaded");
+    }, 
+
 	get_log_check: function(action = 'start') {
 
 		var importLogInterval = setInterval(function() {
 			mw.restore.get_log();
 		}, 2000);
diff --git a/userfiles/modules/microweber/api/api.js b/userfiles/modules/microweber/api/api.js
index 314a5c42d67..57d2ff52e32 100644
--- a/userfiles/modules/microweber/api/api.js
+++ b/userfiles/modules/microweber/api/api.js
@@ -553,10 +553,12 @@ mw.getScripts = function (array, callback) {
 
         }
       }
     });
   }
+
+
   mw.temp_reload_module_queue_holder = [];
 
 
 
 

Fixed code: 
                mw.restore.reload_mw_db();
                mw.clear_cache();

    reload_mw_db: function () {
        $.post(mw.settings.api_url + 'mw_post_update');
        mw.notification.success("The DB was reloaded");
    },
CVE-2022-0505: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2022-02-08T09:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Content/routes/api.php
Commit date: 2022-02-02 13:06:34 +0200
Commit message: Update api.php

Diff: diff --git a/src/MicroweberPackages/Content/routes/api.php b/src/MicroweberPackages/Content/routes/api.php
index 31043a02dc4..3c57ba9c149 100644
--- a/src/MicroweberPackages/Content/routes/api.php
+++ b/src/MicroweberPackages/Content/routes/api.php
@@ -73,11 +73,11 @@ Route::name('api.')
         });
 
 
         Route::post('content/delete', function (\Illuminate\Http\Request $request) {
             return mw()->content_manager->helpers->delete($request->all());
-        });
+        }); 
 
         Route::get('content/get_link_admin', function (\Illuminate\Http\Request $request) {
 
             if (!isset($request['id'])) {
                 return false;

Vulnerable code:         });
Fixed code:         });
CVE-2022-0557: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: OS Command Injection in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 7.2
Published: 2022-02-11T09:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/functions/plupload.php
Commit date: 2022-02-10 10:27:09 +0200
Commit message: Update plupload.php

Diff: diff --git a/src/MicroweberPackages/App/functions/plupload.php b/src/MicroweberPackages/App/functions/plupload.php
index 5f498a75b69..9c78ab6e710 100644
--- a/src/MicroweberPackages/App/functions/plupload.php
+++ b/src/MicroweberPackages/App/functions/plupload.php
@@ -147,18 +147,17 @@ if ($allowed_to_upload == false) {
                         if (trim($allowed_file_type_item) != '' and $fileName_ext != '') {
                             $is_ext = get_file_extension($fileName_ext);
                             $is_ext = strtolower($is_ext);
 
                             switch ($is_ext) {
-                                case 'php':
+                                case 'php': 
                                 case 'php12':
                                 case 'php11':
                                 case 'php10':
                                 case 'php9':
                                 case 'php8':
                                 case 'php7':
-                                case 'php6':
                                 case 'php5':
                                 case 'php4':
                                 case 'php3':
                                 case 'ptml':
                                 case 'html':

Vulnerable code:                                 case 'php':
                                case 'php6':
Fixed code:                                 case 'php':
CVE-2022-0558: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-10T10:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Helper/HTMLClean.php, userfiles/modules/tags/TaggingTagsManager.php
Commit date: 2022-02-10 11:36:59 +0200
Commit message: xss fix on tagging module

Diff: diff --git a/src/MicroweberPackages/Helper/HTMLClean.php b/src/MicroweberPackages/Helper/HTMLClean.php
index 2a20e428ca8..d9cac9b20fd 100644
--- a/src/MicroweberPackages/Helper/HTMLClean.php
+++ b/src/MicroweberPackages/Helper/HTMLClean.php
@@ -2,10 +2,22 @@
 
 namespace MicroweberPackages\Helper;
 
 class HTMLClean
 {
+    public function cleanArray($array) {
+        if (is_array($array)) {
+
+            $cleanedArray = [];
+            foreach ($array as $key=>$value) {
+                $cleanedArray[$key] = $this->clean($value);
+            }
+
+            return $cleanedArray;
+        }
+    }
+
     public function clean($html) {
 
         $antiXss = new \voku\helper\AntiXSS();
         $html = $antiXss->xss_clean($html);
 
diff --git a/userfiles/modules/tags/TaggingTagsManager.php b/userfiles/modules/tags/TaggingTagsManager.php
index df86b670225..dd1e191b8fd 100644
--- a/userfiles/modules/tags/TaggingTagsManager.php
+++ b/userfiles/modules/tags/TaggingTagsManager.php
@@ -64,10 +64,13 @@ function tagging_tag_edit($params) {
     $newData['description'] = $params['description'];
     if (isset($params['id'])) {
         $newData['id'] = $params['id'];
     }
 
+    $cleanInput = new \MicroweberPackages\Helper\HTMLClean();
+    $newData = $cleanInput->cleanArray($newData);
+
     if (isset($params['tagging_tag_id']) && !empty($params['tagging_tag_id'])) {
         $tagging_tag_id = $params['tagging_tag_id'];
         $tag = db_get('tagging_tags', [
             'no_cache'=>false,
             'id'=>$tagging_tag_id,
@@ -103,11 +106,10 @@ function tagging_tag_edit($params) {
             $newData['id'] = $findTaggingTag['id'];
             return ['status'=>false,'message'=>'The tag slug is allready exists.', 'id'=> $newData['id']];
         }
     }
 
-
     $tagSaved = db_save('tagging_tags',$newData);
     if ($tagSaved) {
 
         if (!isset($newData['id'])) {
             $newData['id'] = $tagSaved;

Fixed code:     public function cleanArray($array) {
        if (is_array($array)) {

            $cleanedArray = [];
            foreach ($array as $key=>$value) {
                $cleanedArray[$key] = $this->clean($value);
            }

            return $cleanedArray;
        }
    }

    $cleanInput = new \MicroweberPackages\Helper\HTMLClean();
    $newData = $cleanInput->cleanArray($newData);
CVE-2022-0560: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open Redirect in Packagist microweber/microweber prior to 1.2.11.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-02-11T13:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Page/routes/web.php, tests/Browser/AdminXssTest.php
Commit date: 2022-02-10 14:49:38 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Page/routes/web.php b/src/MicroweberPackages/Page/routes/web.php
index 679fd6dbead..39cc963c8f6 100644
--- a/src/MicroweberPackages/Page/routes/web.php
+++ b/src/MicroweberPackages/Page/routes/web.php
@@ -9,7 +9,7 @@
 Route::name('admin.')
     ->prefix('admin')
     ->middleware(['admin'])
     ->namespace('\MicroweberPackages\Page\Http\Controllers\Admin')
     ->group(function () {
-        Route::resource('page', 'PageController');
+        Route::resource('page', 'PageController', ['except' => ['show']]);
     });
diff --git a/tests/Browser/AdminXssTest.php b/tests/Browser/AdminXssTest.php
index 172a1d57244..2871ac04d21 100644
--- a/tests/Browser/AdminXssTest.php
+++ b/tests/Browser/AdminXssTest.php
@@ -31,11 +31,11 @@ class AdminXssTest extends DuskTestCase
 
                     $browser->within(new ChekForJavascriptErrors(), function ($browser) {
                         $browser->validate();
                     });
 
-                    $browser->pause(2000);
+                 //   $browser->pause(2000);
                 }
             }
 
 
         });

Vulnerable code:         Route::resource('page', 'PageController');
                    $browser->pause(2000);
Fixed code:         Route::resource('page', 'PageController', ['except' => ['show']]);
                 //   $browser->pause(2000);
CVE-2022-0596: Improper Validation of Specified Quantity in Input (CWE-1284)
value: Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CVSS v3 base score: 4.3
Published: 2022-02-15T14:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: tests/Browser/Components/AdminMakeInstall.php
Commit date: 2022-02-14 15:30:03 +0200
Commit message: Update AdminMakeInstall.php

Diff: diff --git a/tests/Browser/Components/AdminMakeInstall.php b/tests/Browser/Components/AdminMakeInstall.php
index 5ea17898ec1..bf26b36ccdc 100644
--- a/tests/Browser/Components/AdminMakeInstall.php
+++ b/tests/Browser/Components/AdminMakeInstall.php
@@ -40,11 +40,11 @@ class AdminMakeInstall extends BaseComponent
         return [];
     }
 
     public function makeInstallation(Browser $browser)
     {
-        $siteUrl = site_url();
+        $siteUrl = 'http://127.0.0.1:8000/';
 
         if (mw_is_installed()) {
             PHPUnit::assertTrue(true);
             return true;
         }

Vulnerable code:         $siteUrl = site_url();
Fixed code:         $siteUrl = 'http://127.0.0.1:8000/';
CVE-2022-0597: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open Redirect in Packagist microweber/microweber prior to 1.2.11.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-02-15T14:15Z
Repository: https://github.com/microweber/microweber
Language: Unknown
Commit date: 2022-02-14 13:20:58 +0200
Commit message: Merge branch 'dev' of https://github.com/microweber/microweber into dev
CVE-2022-0638: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2022-02-17T17:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/User/Http/Controllers/UserLogoutController.php
Commit date: 2022-02-16 18:19:52 +0200
Commit message: Update UserLogoutController.php

Diff: diff --git a/src/MicroweberPackages/User/Http/Controllers/UserLogoutController.php b/src/MicroweberPackages/User/Http/Controllers/UserLogoutController.php
index 2f9e658fcb3..4f83b197f01 100644
--- a/src/MicroweberPackages/User/Http/Controllers/UserLogoutController.php
+++ b/src/MicroweberPackages/User/Http/Controllers/UserLogoutController.php
@@ -3,10 +3,11 @@
 namespace MicroweberPackages\User\Http\Controllers;
 
 use App\Http\Resources\User\UserResource;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Auth;
 use MicroweberPackages\App\Http\Middleware\SameSiteRefererMiddleware;
 
 class UserLogoutController extends Controller
 {
     public $middleware = [
@@ -40,9 +41,13 @@ class UserLogoutController extends Controller
         return view('user::logout.index');
     }
 
     public function submit(Request $request)
     {
-        return logout();
+        Auth::logout();
+
+        $url = site_url();
+
+        return app()->url_manager->redirect($url);
     }
 
 }

Vulnerable code:         return logout();
Fixed code: use Illuminate\Support\Facades\Auth;
        Auth::logout();

        $url = site_url();

        return app()->url_manager->redirect($url);
CVE-2022-0660: Generation of Error Message Containing Sensitive Information (CWE-209)
value: Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 7.5
Published: 2022-02-18T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Comment/Models/Comment.php
Commit date: 2022-02-17 11:15:14 +0200
Commit message: Update Comment.php

Diff: diff --git a/src/MicroweberPackages/Comment/Models/Comment.php b/src/MicroweberPackages/Comment/Models/Comment.php
index fa76a64345f..6e543a876fd 100644
--- a/src/MicroweberPackages/Comment/Models/Comment.php
+++ b/src/MicroweberPackages/Comment/Models/Comment.php
@@ -3,14 +3,16 @@
 namespace MicroweberPackages\Comment\Models;
 
 use EloquentFilter\Filterable;
 use Illuminate\Database\Eloquent\Model;
 use MicroweberPackages\Content\Models\ModelFilters\ContentFilter;
+use MicroweberPackages\Core\Models\HasSearchableTrait;
 
 class Comment extends Model
 {
     use Filterable;
+    use HasSearchableTrait;
 
     public $table = 'comments';
 
     protected $fillable = [
         'rel_type',
@@ -19,10 +21,17 @@ class Comment extends Model
         'comment_email',
         'comment_website',
         'comment_body',
     ];
 
+    protected $searchable = [
+        'comment_name',
+        'comment_email',
+        'comment_website',
+        'comment_body',
+    ];
+
     public function modelFilter()
     {
         return $this->provideFilter(ContentFilter::class);
     }
 

Fixed code: use MicroweberPackages\Core\Models\HasSearchableTrait;
    use HasSearchableTrait;
    protected $searchable = [
        'comment_name',
        'comment_email',
        'comment_website',
        'comment_body',
    ];
CVE-2022-0666: Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
value: CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CVSS v3 base score: 7.5
Published: 2022-02-18T15:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Helper/UrlManager.php
Commit date: 2022-02-17 16:49:46 +0200
Commit message: Update UrlManager.php

Diff: diff --git a/src/MicroweberPackages/Helper/UrlManager.php b/src/MicroweberPackages/Helper/UrlManager.php
index 1e7a0b48a55..ed94787e1a5 100644
--- a/src/MicroweberPackages/Helper/UrlManager.php
+++ b/src/MicroweberPackages/Helper/UrlManager.php
@@ -109,13 +109,12 @@ class UrlManager
             if ($parseUrl['host'] == site_hostname()) {
                 $redirectUrl = $url;
             }
         }
 
-        if (!filter_var($redirectUrl, FILTER_VALIDATE_URL)) {
-            $redirectUrl = site_url();
-        }
+        $redirectUrl = str_replace("\r", "", $redirectUrl);
+        $redirectUrl = str_replace("\n", "", $redirectUrl);
 
         if (headers_sent()) {
             echo '<meta http-equiv="refresh" content="0;url=' . $redirectUrl . '">';
         } else {
             return \Redirect::to($redirectUrl);

Vulnerable code:         if (!filter_var($redirectUrl, FILTER_VALIDATE_URL)) {
            $redirectUrl = site_url();
        }
Fixed code:         $redirectUrl = str_replace("\r", "", $redirectUrl);
        $redirectUrl = str_replace("\n", "", $redirectUrl);
CVE-2022-0678: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-19T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Helper/UrlManager.php
Commit date: 2022-02-18 12:09:45 +0200
Commit message: Update UrlManager.php

Diff: diff --git a/src/MicroweberPackages/Helper/UrlManager.php b/src/MicroweberPackages/Helper/UrlManager.php
index ed94787e1a5..cff71b4dc1b 100644
--- a/src/MicroweberPackages/Helper/UrlManager.php
+++ b/src/MicroweberPackages/Helper/UrlManager.php
@@ -112,10 +112,13 @@ class UrlManager
         }
 
         $redirectUrl = str_replace("\r", "", $redirectUrl);
         $redirectUrl = str_replace("\n", "", $redirectUrl);
 
+        $clearInput = new HTMLClean();
+        $redirectUrl = $clearInput->clean($redirectUrl);
+
         if (headers_sent()) {
             echo '<meta http-equiv="refresh" content="0;url=' . $redirectUrl . '">';
         } else {
             return \Redirect::to($redirectUrl);
         }

Fixed code:         $clearInput = new HTMLClean();
        $redirectUrl = $clearInput->clean($redirectUrl);
CVE-2022-0688: Insufficient Information (NVD-CWE-noinfo)
value: Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 4.9
Published: 2022-02-20T15:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Cart/CartManager.php
Commit date: 2022-02-19 16:42:38 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Cart/CartManager.php b/src/MicroweberPackages/Cart/CartManager.php
index 33397f7c182..92399a9525d 100644
--- a/src/MicroweberPackages/Cart/CartManager.php
+++ b/src/MicroweberPackages/Cart/CartManager.php
@@ -351,13 +351,13 @@ class CartManager extends Crud
         }
 
         $cart = array();
         $cart['id'] = intval($data['id']);
 
-        if ($this->app->user_manager->is_admin() == false) {
-            $cart['session_id'] = mw()->user_manager->session_id();
-        }
+       // if ($this->app->user_manager->is_admin() == false) {
+        $cart['session_id'] = mw()->user_manager->session_id();
+       // }
 
         $cart['order_completed'] = 0;
         $cart['one'] = 1;
         $cart['limit'] = 1;
 

Vulnerable code:         if ($this->app->user_manager->is_admin() == false) {
            $cart['session_id'] = mw()->user_manager->session_id();
        }
Fixed code:        // if ($this->app->user_manager->is_admin() == false) {
        $cart['session_id'] = mw()->user_manager->session_id();
       // }
CVE-2022-0719: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-23T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Helper/UrlManager.php
Commit date: 2022-02-22 12:18:26 +0200
Commit message: Update UrlManager.php

Diff: diff --git a/src/MicroweberPackages/Helper/UrlManager.php b/src/MicroweberPackages/Helper/UrlManager.php
index 4e277892b04..74996d7aa52 100644
--- a/src/MicroweberPackages/Helper/UrlManager.php
+++ b/src/MicroweberPackages/Helper/UrlManager.php
@@ -274,11 +274,12 @@ class UrlManager
         $u1 = implode('/', $this->segment(-1, $url));
 
 
         // clear request params
         $cleanParam = new HTMLClean();
-        $u1 = $cleanParam->cleanArray($u1);
+        $u1 = $cleanParam->clean($u1);
+
 
         return $u1;
     }
 
     /**

Vulnerable code:         $u1 = $cleanParam->cleanArray($u1);
Fixed code:         $u1 = $cleanParam->clean($u1);