TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-9chx-2vqw-8vq5
Summary: Path Traversal in the Logs plugin for Craft CMS
Aliases: CVE-2022-23409
Severity: MODERATE
CWE: CWE-22
Published: 2022-02-01T00:01:00Z

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.
Vulnerability: GHSA-gqcf-83rq-gpfr
Summary: Any storage file can be downloaded from p.sh if full server path is known
Severity: HIGH
CWE: CWE-200
Published: 2021-09-14T20:24:44Z

The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.
Vulnerability: GHSA-rr8m-29g8-8cgc
Summary: SQL Injection in Fork CMS
Aliases: CVE-2022-1064
Severity: HIGH
CWE: CWE-89
Published: 2022-03-26T00:00:32Z

Fork CMS is vulnerable to SQL injection through marking blog comments on bulk as spam in versions prior to 5.11.1.
Vulnerability: GHSA-2xhg-w2g5-w95x
Summary: CSV Injection in symfony/serializer
Aliases: CVE-2021-41270
Severity: MODERATE
CWE: CWE-1236
Published: 2021-11-24T21:01:23Z

Description
-----------

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with `=` is interpreted by the software as a formula and could be abused by an attacker.

In Symfony 4.1, we've added the opt-in `csv_escape_formulas` option in `CsvEncoder`, to prefix all cells starting by  `=`, `+`, `-` or `@` by a tab `\t`. 

Since then, OWASP added 2 chars in that list: 
- Tab (0x09)
- Carriage return (0x0D)

This makes our previous prefix char (Tab `\t`) part of the vulnerable characters, and [OWASP suggests](https://owasp.org/www-community/attacks/CSV_Injection) using the single quote `'` for prefixing the value.

Resolution
----------

Symfony now follows the OWASP recommendations and use the single quote `'` to prefix formulas and adds the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8) for branch 4.4.

Credits
-------

We would like to thank Jake Barwell for reporting the issue and Jérémy Derussé for fixing the issue.
Vulnerability: GHSA-x7g2-wrrp-r6h3
Summary: Use of a Broken or Risky Cryptographic Algorithm
Aliases: CVE-2021-27913
Severity: LOW
CWE: CWE-327
Published: 2021-09-01T18:41:06Z

## ✍️ Description
The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control

## 🕵️‍♂️ Proof of Concept
Numerous examples and attack implementations can be found in this paper . If you're looking for a practical tool that can crack your mt_rand implementation's seed value, see this project and run the following commands in a console with php5 and OpenWall's tool installed:

`root$ php -r 'mt_srand(13333337); echo mt_rand( ), "\n";'`
After that, copy the output (1863134308) and execute the following commands:

`root$ gcc php_mt_seed.c -o php_mt_seedroot$ ./php_mt_seed 1863134308`
After waiting ~1 minute you should have a few possible seeds corresponding to their PHP versions, next to your installed PHP version you should see something akin to:

seed = 0x00cb7359 = 13333337 (PHP 7.1.0+)
Hey, that's your seed!

## 💥 Impact
An attacker could takeover accounts at random by enumerating and using access tokens.

## 📝 References

- https://openwall.com/php_mt_seedhttps://crypto.di.uoa.gr/CRYPTO.SEC/Randomness_Attacks_files/paper.pdf
- https://github.com/mautic/mautic/blob/5213e320b4ef4d0c51bb84c1d46a1071e8e4f7fc/app/bundles/PointBundle/Controller/TriggerController.php#L187
- https://github.com/mautic/mautic/releases/tag/3.3.4
- https://github.com/mautic/mautic/releases/tag/4.0.0
Vulnerability: GHSA-rf3w-29h3-r636
Summary: Arbitrary Code Execution in feehi/cms
Aliases: CVE-2020-21322
Severity: HIGH
CWE: CWE-434
Published: 2021-09-20T20:45:35Z

An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.
Vulnerability: GHSA-6gjf-7w99-j7x7
Summary: Deleted Admin Can Sign In to Admin Interface
Aliases: CVE-2021-41126
Severity: HIGH
CWE: CWE-287
Published: 2021-10-06T17:46:40Z

### Impact
Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0.

### Patches
The issue has been patched in v2.1.12

### Workarounds

- Reset the password of the deleted accounts to prevent them from signing in.

- Please contact hello@octobercms.com for code change instructions if you are unable to upgrade.

### References

Credits to:
• Daniel Bidala

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-pccm-j6vj-jwwf
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0962
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-15T00:00:54Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via `.webma` file upload.
Vulnerability: GHSA-pq2f-3fg3-rw99
Summary: SQL Injection in WordPress Zero Spam WordPress plugin
Aliases: CVE-2022-0254
Severity: CRITICAL
CWE: CWE-89
Published: 2022-03-15T00:00:57Z

The WordPress Zero Spam WordPress plugin before 5.2.13 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Vulnerability: GHSA-v4cr-m5f8-gxw8
Summary: yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4092
Severity: MODERATE
CWE: CWE-352
Published: 2021-12-16T14:14:56Z

yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-m8rp-q82r-c5mf
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0278
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-21T18:06:49Z

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-x3g3-jh26-76cf
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0375
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T23:06:00Z

LiveHelperChat is vulnerable to Stored XSS at the Name field in the Admin themes of System configuration.
Vulnerability: GHSA-pcwq-7wrw-r8jv
Summary: Cross-site Scripting in intelliants/subrion
Aliases: CVE-2020-18325
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-05T00:00:45Z

Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.
Vulnerability: GHSA-6vx5-cg2p-7g5v
Summary: Unrestricted Upload of File with Dangerous Type in microweber
Aliases: CVE-2022-0912
Severity: MODERATE
CWE: CWE-434
Published: 2022-03-12T00:00:35Z

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.12.
Vulnerability: GHSA-jc43-qrrp-98f5
Summary: Insert tag injection in the Contao login module
Aliases: CVE-2019-19714
Severity: MODERATE
CWE: CWE-116
Published: 2019-12-17T22:53:40Z

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. It is possible to inject insert tags into the login module which will be replaced when the page is rendered. It is recommended to update to Contao 4.8.6. There are currently no known workarounds at this time.
Vulnerability: GHSA-qjhr-c23f-w76q
Summary: Inline JS XSS vulnerability in Mautic
Aliases: CVE-2017-1000488
Severity: MODERATE
CWE: CWE-79
Published: 2021-01-19T21:16:24Z

### Impact

Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.

### Patches
Upgrade to 2.12.0 or later.

### Workarounds
None

### References
https://github.com/mautic/mautic/releases/tag/2.12.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-4cx9-7xqc-2jxm
Summary: Reflected cross-site scripting in francoisjacquet/rosariosis
Aliases: CVE-2020-13278
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-06T18:54:48Z

Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request.
Vulnerability: GHSA-xv69-f7x5-r4qw
Summary: Cross-Site Scripting via Attribute Set Name
Aliases: CVE-2019-8145
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-12T22:59:43Z

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products.
Vulnerability: GHSA-8rc5-hx3v-2jg7
Summary: Sanitizer bypass in svg-sanitizer
Aliases: CVE-2019-10772
Severity: MODERATE
CWE: CWE-79
Published: 2020-02-27T20:36:29Z

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.
Vulnerability: GHSA-hrfh-fp4x-crrq
Summary: Persistent XSS in newsletter module in Shopware
Severity: LOW
CWE: CWE-79
Published: 2020-11-13T18:26:06Z

### Impact
Persistent XSS in newsletter module

### Patches

We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020
Vulnerability: GHSA-v8wr-r69p-mmwx
Summary: Unrestricted Upload of File with Dangerous Type in Drupal core
Aliases: CVE-2020-13675
Severity: CRITICAL
CWE: CWE-434, CWE-284
Published: 2022-02-12T00:00:47Z

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
Vulnerability: GHSA-2gc7-w4hw-rr2m
Summary: class.upload.php in verot.net omits .pht from the set of dangerous file extensions
Aliases: CVE-2019-19634
Severity: CRITICAL
CWE: CWE-434
Published: 2020-02-28T01:10:17Z

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
Vulnerability: GHSA-8pfh-mm2g-hmc3
Summary: Authenticated Server Side Request Forgery
Severity: LOW
CWE: CWE-918
Published: 2020-12-21T18:01:24Z

### Impact
Authenticated Server Side Request Forgery

### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020

### Credits
We would like to thank <a rel="noopener" href="https://reqon.nl">REQON B.V.</a> for reporting this issue.
Vulnerability: GHSA-r336-jxfr-4c3c
Summary: Path Traversal in LibreNMS
Aliases: CVE-2019-12464
Severity: HIGH
CWE: CWE-22
Published: 2019-10-11T18:43:25Z

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution.
Vulnerability: GHSA-vhfp-9wvj-gwvg
Summary: XML External Entity vulnerability in MODX CMS
Aliases: CVE-2020-25911
Severity: CRITICAL
CWE: CWE-611
Published: 2021-11-01T19:19:43Z

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).
Vulnerability: GHSA-cxg7-84wp-8pcq
Summary: yetiforcecrm is vulnerable to Business Logic Errors
Aliases: CVE-2021-4117
Severity: HIGH
Published: 2021-12-16T21:01:07Z

yetiforcecrm is vulnerable to Business Logic Errors.
Vulnerability: GHSA-5rg2-6qr5-2xp8
Summary: Cross-site Scripting in snipe-it
Aliases: CVE-2021-3863
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-21T17:49:18Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-fm35-jgg3-3grx
Summary: NaN/INF in serverbound movement packets can crash clients and servers
Severity: HIGH
CWE: CWE-20
Published: 2022-03-18T17:54:38Z

### Impact
A malicious client may send a `MovePlayerPacket` to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play.

- The server may crash in various ways if this exploit is used, because some mathematical operations on NaN/INF generate PHP warnings, which are converted into exceptions.
- Clients may not be able to see other clients who have a NaN/INF rotation.
- Clients may also crash in such cases.

### Patches
A patch for this was included in the 3.18.1 release: https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638

### Workarounds
Workarounds could be implemented as plugins using `DataPacketReceiveEvent` to block any inbound movement packets containing bogus values.

### For more information
If you have any questions or comments about this advisory:

- Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP)
- Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-9vh6-qfv6-vcqp
Summary: snipe-IT vulnerable to host header injection
Aliases: CVE-2022-23064
Severity: HIGH
CWE: CWE-74
Published: 2022-05-03T00:00:43Z

Snipe-IT is a free, open-source IT asset/license management systemIn Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This can lead to account take over.
Vulnerability: GHSA-8vh3-29mr-m9xg
Summary: Inadequate Encryption Strength in showdoc
Aliases: CVE-2021-3680
Severity: MODERATE
CWE: CWE-326
Published: 2021-09-01T18:31:23Z

showdoc makes use of a hardcoded salt in its user password hash function
Vulnerability: GHSA-p3w3-4ppm-c3f6
Summary: Cross site scripting in FacturaScripts
Aliases: CVE-2022-1514
Severity: CRITICAL
CWE: CWE-79
Published: 2022-04-29T00:00:23Z

FacturaScripts prior to version 2022.06 is vulnerable to stored cross-site scripting via upload plugin functionality in zip format.
Vulnerability: GHSA-2v7p-f4qm-r5pc
Summary: SQL Injection found in Pimcore
Aliases: CVE-2022-1429
Severity: HIGH
CWE: CWE-89
Published: 2022-04-23T00:03:03Z

Pimcore is an open source data & experience management platform. A SQL injection was discovered in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6.
Vulnerability: GHSA-6gm7-j668-w6h9
Summary: SQL Injection in Pimcore
Aliases: CVE-2022-1219
Severity: HIGH
CWE: CWE-89
Published: 2022-04-09T00:00:30Z

Pimcore prior to version 10.3.5 is vulnerable SQL injection in RecyclebinController.php. This vulnerability affects data confidentiality.
Vulnerability: GHSA-m4hj-wg2r-qpcr
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3776
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-15T23:13:34Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-4q96-9f63-p7jj
Summary: Path Traversal in ImpressCMS
Aliases: CVE-2021-26601
Severity: HIGH
CWE: CWE-22
Published: 2022-03-29T00:01:16Z

ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.
Vulnerability: GHSA-gf8j-v8x5-h9qp
Summary: XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes
Aliases: CVE-2019-18857
Severity: HIGH
CWE: CWE-79
Published: 2020-01-08T17:15:37Z

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript&#9;:alert substring.
Vulnerability: GHSA-g9xh-3w5g-229r
Summary: SQL Injection in LibreNMS
Aliases: CVE-2019-10671
Severity: HIGH
CWE: CWE-89
Published: 2019-10-11T18:43:33Z

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.
Vulnerability: GHSA-mf79-f657-47ww
Summary: Insufficient Session Expiration in Admidio
Aliases: CVE-2022-0991
Severity: HIGH
CWE: CWE-613
Published: 2022-03-20T00:00:29Z

Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account.
Vulnerability: GHSA-vrgh-5w3c-ggf8
Summary: showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Aliases: CVE-2021-3990
Severity: MODERATE
CWE: CWE-338
Published: 2021-12-03T20:38:50Z

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG).
Vulnerability: GHSA-vhm6-gw82-6f8j
Summary: Cross site scripting in LibreNMS
Aliases: CVE-2022-0772
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-28T00:00:34Z

LibreNMS prior to version 22.2.2 is vulnerable to cross-site scripting.
Vulnerability: GHSA-xh55-2fqp-p775
Summary: Command injection in mail agent settings
Aliases: CVE-2021-37708
Severity: HIGH
CWE: CWE-77
Published: 2021-08-30T16:14:09Z

### Impact
Command injection in mail agent settings

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-w2pm-r78h-4m7v
Summary: OS Command Injection in Laravel Framework
Aliases: CVE-2020-19316
Severity: HIGH
CWE: CWE-78
Published: 2022-01-06T23:13:42Z

OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
Vulnerability: GHSA-8x44-pwr2-rgc6
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2022-0348
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T23:05:03Z

Pimcore settings module is vulnerable to stored cross site scripting
Vulnerability: GHSA-7h8v-2v8x-h264
Summary: SQL Injection in moodle
Aliases: CVE-2020-25700
Severity: MODERATE
CWE: CWE-89
Published: 2021-03-29T20:42:19Z

In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10.
Vulnerability: GHSA-6xxj-gcjq-wgf4
Summary: SQL injection in prestashop/prestashop
Aliases: CVE-2021-43789
Severity: HIGH
CWE: CWE-89
Published: 2021-12-07T21:23:17Z

### Impact
Blind SQLi using Search filters with `orderBy` and `sortOrder` parameters

### Patches
The problem is fixed in 1.7.8.2
Vulnerability: GHSA-w8cj-mvf9-mpc9
Summary: OS Command injection in Bolt
Aliases: CVE-2020-28925
Severity: MODERATE
CWE: CWE-78
Published: 2021-05-06T18:53:29Z

Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Your PHP for Better Security" guidance.
Vulnerability: GHSA-gm2x-6475-g9r8
Summary: XSS Injection in Media Collection Title was possible
Aliases: CVE-2021-32737
Severity: MODERATE
CWE: CWE-79
Published: 2021-07-02T18:32:18Z

### Impact

A logged in admin user was possible to add a script injection (XSS) in the collection title which was executed.

### Workarounds

Manual patching the js files.

### For more information

If you have any questions or comments about this advisory:'

 - Email us at [security@sulu.io](mailto:security@sulu.io)
Vulnerability: GHSA-32wx-4gxx-h48f
Summary: Users can edit the tags of any discussion
Severity: MODERATE
CWE: CWE-639
Published: 2021-01-29T18:13:32Z

This advisory concerns a vulnerability which was patched and publicly released on October 5, 2020.

### Impact
This vulnerability allowed any registered user to edit the tags of any discussion for which they have READ access using the REST API.

Users were able to remove any existing tag, and add any tag in which they are allowed to create discussions. The chosen tags still had to match the configured Tags minimums and maximums.

By moving the discussion to new tags, users were able to go around permissions applied to restricted tags. Depending on the setup, this can include publicly exposing content that was only visible to certain groups, or gain the ability to interact with content where such interaction was limited.

The full impact varies depending on the configuration of permissions and restricted tags, and which community extensions are being used. All tag-scoped permissions offered by extensions are impacted by this ability to go around them.

Forums that don't use restricted tags and don't use any extension that relies on tags for access control should not see any security impact. An update is still required to stop users from being able to change any discussion's tags.

Forums that don't use the Tags extension are unaffected.

### Patches
The fix will be available in version v0.1.0-beta.14 with Flarum beta 14. The fix has already been back-ported to Flarum beta 13 as version v0.1.0-beta.13.2 of the Tags extension.

### Workarounds
Version v0.1.0-beta.13.2 of the Tags extension allows existing Flarum beta 13 forums to fix the issue without the need to update to beta 14.

Forums that have not yet updated to Flarum beta 13 are encouraged to update as soon as possible.

### References

- [Release announcement](https://discuss.flarum.org/d/25059-security-update-to-flarum-tags-010-beta132)
- [GitHub issue](https://github.com/flarum/core/issues/2355)

### For more information
If you have any questions or comments about this advisory, please start a new discussion on our [support forum](https://discuss.flarum.org/t/support).

If you discover a security vulnerability within Flarum, please send an e-mail to [security@flarum.org](mailto:security@flarum.org). All security vulnerabilities will be promptly addressed. More details can be found in our [security policy](https://github.com/flarum/core/security/policy).
Vulnerability: GHSA-f545-vpwp-r9j7
Summary: showdoc is vulnerable to URL Redirection to Untrusted Site
Aliases: CVE-2021-3989
Severity: MODERATE
CWE: CWE-601
Published: 2021-12-03T20:41:35Z

showdoc is vulnerable to URL Redirection to Untrusted Site.
Vulnerability: GHSA-5fvx-5p2r-4mvp
Summary: Open Redirect in firefly-iii
Aliases: CVE-2021-3851
Severity: MODERATE
CWE: CWE-601
Published: 2021-10-21T17:48:41Z

firefly-iii is vulnerable to URL Redirection to Untrusted Site
Vulnerability: GHSA-j586-cj67-vg4p
Summary: Cross-Site Request Forgery in Drupal core
Aliases: CVE-2020-13674
Severity: MODERATE
CWE: CWE-352
Published: 2022-02-12T00:00:47Z

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
Vulnerability: GHSA-34hv-f45p-4qfq
Summary: Open redirect in wwbn/avideo
Aliases: CVE-2022-27463
Severity: MODERATE
CWE: CWE-601
Published: 2022-04-06T00:01:29Z

Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page. A patch is available on the `master` branch of the repository.
Vulnerability: GHSA-pqm6-cgwr-x6pf
Summary: Signature validation bypass in XmlSecLibs
Aliases: CVE-2019-3465
Severity: HIGH
CWE: CWE-347
Published: 2019-11-08T20:06:46Z

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.
Vulnerability: GHSA-68v9-3jjq-rvp4
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-32716
Severity: MODERATE
CWE: CWE-200
Published: 2021-09-08T18:00:40Z

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
Vulnerability: GHSA-6wrh-279j-6hvw
Summary: HTTP caching is marking private HTTP headers as public in Shopware
Aliases: CVE-2022-24747
Severity: MODERATE
CWE: CWE-200
Published: 2022-03-10T17:55:21Z

### Impact
HTTP caching is marking private HTTP headers as public

## Patches
Fixed in  recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-fv48-hjhp-94c7
Summary: Incorrect Authorization in TeamPass
Aliases: CVE-2020-12477
Severity: HIGH
CWE: CWE-863
Published: 2021-07-26T21:20:38Z

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function.
Vulnerability: GHSA-v47f-vp3p-5j6h
Summary: "Cross-site scripting in ThinkAdmin"
Aliases: CVE-2020-29315
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-06T18:53:46Z

"ThinkAdmin version v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML."
Vulnerability: GHSA-5822-pw57-vv37
Summary: XSS vulnerability when listing users on add & modify server pages.
Severity: MODERATE
CWE: CWE-79
Published: 2020-10-08T20:13:19Z

### Impact
An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server.

### Patches
This XSS has been addressed in 0.7.19 and will be rolled forwards into the 1.0-rc.7 release.

### Workarounds
No workaround exists without manual patching. See https://github.com/pterodactyl/panel/pull/2441/files for the files changed.

### For more information
If you have any questions or comments about this advisory please reach out on Discord, or by emailing `dane` at `pterodactyl` dot `io`.

_Thank you to Sergej for the responsible disclosure of this issue._
Vulnerability: GHSA-rfcf-m67m-jcrq
Summary: Authentication granted to all firewalls instead of just one
Aliases: CVE-2021-32693
Severity: HIGH
CWE: CWE-287
Published: 2021-06-21T17:03:44Z

Description
-----------

When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a user authenticated on one part of the application is considered authenticated on the whole application.

Resolution
----------

We now ensure that the authenticated token is only available for the firewall that generates it.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728) for branch 5.3.

Credits
-------

I would like to thank Bogdan, gndk, Paweł Warchoł, Warxcell, and Adrien Lamotte for reporting the issue and Wouter J for fixing the issue.
Vulnerability: GHSA-r64m-qchj-hrjp
Summary: Webcache Poisoning in shopware/platform and shopware/core
Severity: CRITICAL
CWE: CWE-444
Published: 2021-11-24T20:05:19Z

### Impact
Webcache Poisoning via X-Forwarded-Prefix and sub-request

### Patches
We recommend updating to the current version 6.4.6.1. You can get the update to 6.4.6.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-43gj-mj2w-wh46
Summary: Cross-Site Scripting in TYPO3 CMS Form Engine
Aliases: CVE-2020-11064
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-13T23:17:48Z

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML `placeholder` attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-002
Vulnerability: GHSA-4rhm-m2fp-hx7q
Summary: Potential CSV Injection vector in OctoberCMS
Aliases: CVE-2020-5299
Severity: MODERATE
CWE: CWE-77
Published: 2020-06-03T21:58:35Z

### Impact
Any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 

1. Have found a vulnerability in the victim's spreadsheet software of choice.
2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim.
3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a & https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 to your installation manually if unable to upgrade to Build 466.

### References
Reported by @chrisvidal initially & [Sivanesh Ashok](https://stazot.com/) later.

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
Given the number of hoops that a potential attacker would have to jump through, this vulnerability really boils down to the possibility of abusing the trust that a user may have in the export functionality of the project. Thus, this has been rated low severity as it requires vulnerabilities to also exist in other software used by any potential victims as well as successful social engineering attacks.
Vulnerability: GHSA-h5h8-pc6h-jvvx
Summary: Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer
Aliases: CVE-2021-29472
Severity: HIGH
CWE: CWE-94, CWE-88
Published: 2021-04-29T21:52:04Z

URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow commands to be executed in the HgDriver if hg/Mercurial is installed on the system.

### Impact
- The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins.
- The main impact is to services passing user input to Composer, including Packagist.org and Private Packagist. This allowed users to trigger remote command injection. The vulnerability has been patched on Packagist.org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs, to the best of our knowledge, was not abused by anyone.
- Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately

### Patches
1.10.22 and 2.0.13 include patches for this issue.
Vulnerability: GHSA-42qm-c3cf-9wv2
Summary: Code injection in dolibarr/dolibarr
Aliases: CVE-2022-0819
Severity: HIGH
CWE: CWE-94
Published: 2022-03-03T00:00:49Z

Improper php function sanitization, lead to an ability to inject arbitrary PHP code and run arbitrary commands on file system. In the function "dol_eval" in file "dolibarr/htdocs/core/lib/functions.lib.php" dangerous PHP functions are sanitized using "str_replace" and can be bypassed using following code in $s parameter
Vulnerability: GHSA-j66h-cc96-c32q
Summary: Cross-site Scripting in SilverStripe Framework
Aliases: CVE-2021-36150
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-12T18:42:30Z

SilverStripe Framework through 4.8.1 allows XSS.
Vulnerability: GHSA-gq77-3r6x-383w
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0880
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-13T00:00:54Z

ShowDoc version 2.10.3 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-2q66-6cc3-6xm8
Summary: CSRF issue on preview pages in Bolt CMS
Aliases: CVE-2020-4040
Severity: HIGH
CWE: CWE-352
Published: 2020-06-09T00:25:41Z

### Impact

Bolt CMS lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview.

### Patches

This has been fixed in Bolt 3.7.1

### References

Related issue: https://github.com/bolt/bolt/pull/7853
Vulnerability: GHSA-5q5w-mqp6-g2gh
Summary: Unrestricted Upload of File with Dangerous Type in jsdecena/laracom
Aliases: CVE-2022-0472
Severity: MODERATE
CWE: CWE-79, CWE-434
Published: 2022-02-06T00:01:07Z

jsdecena/laracom prior to version 2.0.9 is vulnerable to Unrestricted Upload of File with Dangerous Type.
Vulnerability: GHSA-hhrj-wp42-32v3
Summary: Generation of Error Message Containing Sensitive Information in microweber
Aliases: CVE-2022-0660
Severity: HIGH
CWE: CWE-209
Published: 2022-02-19T00:01:36Z

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-6x3j-x9rp-whxp
Summary: Unrestricted Upload of File with Dangerous Type in showdoc
Aliases: CVE-2022-0409
Severity: HIGH
CWE: CWE-434
Published: 2022-02-20T00:00:32Z

showdoc prior to 2.10.2 is vulnerable to Unrestricted Upload of File with Dangerous Type.
Vulnerability: GHSA-9hx7-rg7w-xm79
Summary: XSS vulnerability in company name field in Mautic
Aliases: CVE-2018-11200
Severity: MODERATE
CWE: CWE-79
Published: 2021-01-19T21:16:26Z

### Impact
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.

### Patches
Update to 2.14.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-22hc-47cc-7x6f
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0894
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:48Z

Pimcore prior to 10.4.0 is vulnerable to stored cross-site scripting.
Vulnerability: GHSA-43g8-79x3-j898
Summary: Unrestricted access to predictable file paths in hov/jobfair
Aliases: CVE-2021-43564
Severity: HIGH
CWE: CWE-200
Published: 2021-11-15T17:36:22Z

An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).
Vulnerability: GHSA-54hw-mhgh-x4vc
Summary: Business Logic Errors in pimcore
Aliases: CVE-2021-4146
Severity: MODERATE
Published: 2022-01-26T22:09:49Z

In pimcore versions prior to 10.2.9 discounts could be negative resulting in unintended behavior.
Vulnerability: GHSA-vx8v-g3p3-88vg
Summary: Weak password hash in LiveHelperChat
Aliases: CVE-2022-1235
Severity: HIGH
CWE: CWE-916
Published: 2022-04-06T00:01:31Z

The secrethash, which the application relies for multiple security measures, can be brute-forced. The hash is quite small, with only 10 characters of only hexadecimal, making 16^10 possilibities ( 1.099.511.627.776 ). The SHA1 of the secret can be obtained via a captcha string and brute-forced offline with an GPU.
Vulnerability: GHSA-mg5h-9rhq-4cqx
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0937
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-15T00:01:02Z

ShowDoc is vulnerable to stored cross-site scripting through file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-m2v2-8227-59f5
Summary: Exposure of sensitive information in concrete5/core
Aliases: CVE-2021-22967
Severity: MODERATE
CWE: CWE-639, CWE-200
Published: 2021-11-23T17:54:39Z

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.
Vulnerability: GHSA-7rpc-9m88-cf9w
Summary: OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS
Aliases: CVE-2021-41243
Severity: CRITICAL
CWE: CWE-78
Published: 2021-12-01T18:29:42Z

There is an OS Command Injection Vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

Target
baserCMS 4.5.3 and earlier versions

Vulnerability
OS Command Injection Vulnerability.

Countermeasures
Update to the latest version of baserCMS

Credits
Akagi Yusuke @NTT-ME
Vulnerability: GHSA-g4gm-pxh3-29fq
Summary: Unrestricted Uploads in Concrete5
Aliases: CVE-2020-14961
Severity: MODERATE
CWE: CWE-434
Published: 2022-02-10T22:28:41Z

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.
Vulnerability: GHSA-9w8f-7wgr-2h7g
Summary: kimai2 is vulnerable to Improper Access Control
Aliases: CVE-2021-3992
Severity: MODERATE
CWE: CWE-863, CWE-284
Published: 2021-12-03T20:42:59Z

kimai2 is vulnerable to Improper Access Control
Vulnerability: GHSA-vfxj-qg93-7wwc
Summary: Sessions could be hijacked due to tracking contacts by an auto-incremented ID in Mautic
Aliases: CVE-2018-10189
Severity: MODERATE
CWE: CWE-200
Published: 2021-01-19T21:16:21Z

### Impact
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.

### Patches
Update to 2.13.0 or later

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-4xc7-x2jr-cr74
Summary: Improper Authorization in dolibarr/dolibarr
Aliases: CVE-2022-0731
Severity: MODERATE
CWE: CWE-863
Published: 2022-02-24T00:00:52Z

Dolibarr allows improper access control issues in the userphoto modulepart. The impact could lead to data exposure as the attached files and documents may contain sensitive information of relevant parties such as contacts, suppliers, invoices, orders, stocks, agenda, accounting and more.
Vulnerability: GHSA-6675-wwqr-jhmf
Summary: Cross-site Scripting in GilaCMS
Aliases: CVE-2020-20695
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-30T17:12:56Z

A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
Vulnerability: GHSA-w5hr-jm4j-9jvq
Summary: Sandbox escape through template_object in smarty
Aliases: CVE-2021-26119
Severity: HIGH
Published: 2021-03-02T02:57:23Z

Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on [Smarty Security features](https://www.smarty.net/docs/en/advanced.features.tpl) should upgrade as soon as possible. Please upgrade to 3.1.39 or higher.
Vulnerability: GHSA-v8mp-hhjq-h4cj
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0965
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:46Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via `.ofd` file upload.
Vulnerability: GHSA-5gm6-r79q-hfgw
Summary: Denial of service in direct_mail
Aliases: CVE-2020-12697
Severity: MODERATE
CWE: CWE-770
Published: 2021-05-24T16:58:32Z

The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.
Vulnerability: GHSA-wpww-4jf4-4hx8
Summary: Edit feed settings  and others, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0
Aliases: CVE-2020-15273
Severity: LOW
CWE: CWE-79
Published: 2020-11-04T21:08:38Z

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS).

Impact: XSS via Arbitrary script execution.
Attack vector is: Administrator must be logged in.
Components are: Edit feed settings, Edit widget area, Sub site new registration, New category registration
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by Aquilao Null
Vulnerability: GHSA-7gm7-8q8v-9gf2
Summary: Server-Side Request Forgery (SSRF) in Shopware
Aliases: CVE-2022-24871
Severity: HIGH
CWE: CWE-918
Published: 2022-04-22T21:04:07Z

### Impact

The  attacker can abuse the Admin SDK functionality on the server to read or update internal resources.

### Patches

We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-73q4-j324-2qcc
Summary: Incorrect authorization in Drupal core
Aliases: CVE-2022-25270
Severity: MODERATE
CWE: CWE-863
Published: 2022-02-18T00:00:36Z

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Vulnerability: GHSA-f6p5-76fp-m248
Summary: URL Rewrite vulnerability in multiple zendframework components
Severity: HIGH
Published: 2022-04-28T21:09:54Z

zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.

When these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.
Vulnerability: GHSA-r6hh-5g3q-wwgc
Summary: Stored Cross-site Scripting in grav
Aliases: CVE-2022-0970
Severity: HIGH
CWE: CWE-79
Published: 2022-03-16T00:00:45Z

Grav prior to 1.7.31 is vulnerable to stored cross-site scripting.
Vulnerability: GHSA-qg7c-q3vq-rgxr
Summary: Leak of information via Store-API aggregations in shopware/platform and shopware/core
Severity: CRITICAL
CWE: CWE-668
Published: 2021-04-13T15:13:26Z

### Impact

Leak of information via Store-API

### Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
Vulnerability: GHSA-qgpv-86r3-87fh
Summary: Cross-site Scripting in Parsedown
Aliases: CVE-2018-1000162
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-30T18:26:22Z

Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.
Vulnerability: GHSA-mvrg-5c4w-7qv4
Summary: Cross-site Scripting in yii2cmf
Aliases: CVE-2018-10704
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-22T15:25:22Z

yidashi yii2cmf 2.0 has XSS via the /search q parameter.