deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-mv3p-7p89-wq9p
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 8.2)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: >= 2.0.0, <= 2.41.0
Patched in: 2.41.1

Summary: Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

Details:
# Security Advisory — Form Plugin (Stored XSS)

## Summary

A Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In the file field of the Form Plugin, Stored Cross-site Scripting (XSS) could occur. If exploited, arbitrary script could run in an administrator's browser, which may lead to unauthorized actions or information theft. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-mv3p-7p89-wq9p
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 8.2)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 1.41.0
Patched in: 1.41.1

Summary: Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

Details:
# Security Advisory — Form Plugin (Stored XSS)

## Summary

A Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In the file field of the Form Plugin, Stored Cross-site Scripting (XSS) could occur. If exploited, arbitrary script could run in an administrator's browser, which may lead to unauthorized actions or information theft. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-cmfh-mpmf-fmq4
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.35.0, < 2.41.1
Patched in: 2.41.1

Summary: Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

Details:
# Security Advisory — Cabinet Plugin (DOM-based XSS)

## Summary

A DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view.

## Affected Versions

- 1.x series: >= 1.35.0, <= 1.41.0
- 2.x series: >= 2.35.0, <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In the Cabinet Plugin list view, DOM-based Cross-Site Scripting (XSS) could occur due to how saved names were rendered.
If exploited, arbitrary script could run in the victim's browser, which may lead to unauthorized actions or information theft.
Exploitation requires that the attacker be able to reach the affected functionality as an authenticated user.
Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-cmfh-mpmf-fmq4
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.35.0, < 1.41.1
Patched in: 1.41.1

Summary: Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

Details:
# Security Advisory — Cabinet Plugin (DOM-based XSS)

## Summary

A DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view.

## Affected Versions

- 1.x series: >= 1.35.0, <= 1.41.0
- 2.x series: >= 2.35.0, <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In the Cabinet Plugin list view, DOM-based Cross-Site Scripting (XSS) could occur due to how saved names were rendered.
If exploited, arbitrary script could run in the victim's browser, which may lead to unauthorized actions or information theft.
Exploitation requires that the attacker be able to reach the affected functionality as an authenticated user.
Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-hxqw-6qv7-cqfv
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2.0.0, < 2.41.1
Patched in: 2.41.1

Summary: Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

Details:
# Security Advisory — Code Study Plugin

## Summary

An authenticated user may be able to execute arbitrary code in the Code Study Plugin.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In the Code Study Plugin, an authenticated user could trigger unintended code execution. If exploited, it may lead to code execution on the server or information disclosure. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-hxqw-6qv7-cqfv
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 1.41.1
Patched in: 1.41.1

Summary: Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

Details:
# Security Advisory — Code Study Plugin

## Summary

An authenticated user may be able to execute arbitrary code in the Code Study Plugin.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In the Code Study Plugin, an authenticated user could trigger unintended code execution. If exploited, it may lead to code execution on the server or information disclosure. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-phrq-pc6r-f6gh
Package: mantisbt/mantisbt (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-305: Authentication Bypass by Primary Weakness
Vulnerable versions: < 2.28.1
Patched in: 2.28.1

Summary: MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

Details:
Mantis Bug Tracker instances running on MySQL and compatible databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of improper type checking on the password parameter.

Other database backends are not affected, as they do not perform implicit type conversion from string to integer.

### Impact
Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to.

### Patches
* b349e5c890eeda9bd82e7c7e14479853f8a30d9f

### Workarounds
- [Disabling the SOAP API](https://mantisbt.org/docs/master/en-US/Admin_Guide/html-desktop/#admin.config.api.disable) significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.

### Resources
- https://mantisbt.org/bugs/view.php?id=36902

### Credits
MantisBT thanks Alexander Philiotis of SynerComm for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-m59h-42jf-cphr
Package: putyourlightson/craft-sprig (COMPOSER)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-489: Active Debug Code
Vulnerable versions: >= 2.0.0, < 2.15.2
Patched in: 2.15.2

Summary: Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground

Details:
Admin users, and users with explicit permission to access the Sprig Playground, could potentially expose the security key, credentials, and other sensitive configuration data, in addition to running the `hashData()` signing function.

This issue was mitigated in versions 3.7.2 and 2.15.2 by disabling access to the Sprig Playground entirely when `devMode` is disabled, by default. It is possible to override this behaviour using a new `enablePlaygroundWhenDevModeDisabled` that defaults to `false`.

References:

- https://github.com/putyourlightson/craft-sprig/commit/db18c46f6dc5603828aa321a3a615adbd677d475
- https://github.com/putyourlightson/craft-sprig/commit/09c9da2ffb45a8857829f3390ae2578e26cfe03b
GitHub Security Advisory: GHSA-8fw8-q79c-fp9m
Package: wwbn/avideo (COMPOSER)
Severity: HIGH (CVSS 8.6)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

Details:
### Summary
An unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., `view/about.php`), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. 
### Details
- Entry point: `plugin/API/get.json.php` sets `$global['bypassSameDomainCheck']=1` and merges GET/POST/JSON into `$parameters` without authentication or API secret.
- Handler: `plugin/API/API.php`, method `get_api_locale()` (lines ~5009–5023):
  ```php
  $parameters['language'] = strtolower($parameters['language']);
  $file = "{$global['systemRootPath']}locale/{$parameters['language']}.php";
  if (!file_exists($file)) { return new ApiObject("This language does not exists"); }
  include $file;
  ```
  No validation is performed; `../` traversal is accepted.
- Because `include` executes PHP, any reachable PHP file is executed in the web server context.

### PoC
1. Fetch an arbitrary PHP file (no auth):
   ```
   GET /plugin/API/get.json.php?APIName=locale&language=../view/about HTTP/1.1
   Host: <target>
   ```
   Response returns the rendered About page HTML, proving traversal outside `locale/`.
2. RCE with an attacker PHP file (any writable PHP path):
   ```
   GET /plugin/API/get.json.php?APIName=locale&language=../videos/locale/shell&x=whoami
   ```
   If `shell.php` contains `<?php system($_GET['x']); ?>`, the response includes command output.

### Impact
- Unauthenticated file inclusion of arbitrary PHP files under the web root.
- Confidential data leakage (e.g., configuration, secrets) via included PHP that renders output.
- Potential RCE *if* any attacker-writable PHP file exists elsewhere (not confirmed in this build).
- Affects any deployment with the API plugin enabled (default in docker-compose).

### Mitigation
- Reject path separators/dots and enforce a strict allowlist of locale slugs.
- `realpath` the target and ensure it stays within `$systemRootPath/locale`.
- Stop using `include` for translations; load data from vetted formats (JSON/array).
- Add authentication (API secret/token) to the endpoint as a secondary control.
GitHub Security Advisory: GHSA-mwjc-5j4x-r686
Package: wwbn/avideo (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-287: Improper Authentication, CWE-312: Cleartext Storage of Sensitive Information, CWE-326: Inadequate Encryption Strength, CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo has an unauthenticated decrypt oracle leaking any ciphertext

Details:
### Summary
The API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Severity: High.

### Details
- Entry: `plugin/API/get.json.php` is unauthenticated.
- Handler: `plugin/API/API.php` `get_api_decryptString()` (lines ~5945–5966):
  ```php
  $string = decryptString($_REQUEST['string']);
  return new ApiObject($string, empty($string));
  ```
  No APISecret or user check occurs before decrypting.
- Public ciphertext source: `view/url2Embed.json.php` returns `playLink`/`playEmbedLink` (`encryptString(json_encode(...))`) to any caller.

### PoC
1. Obtain ciphertext:
   ```
   GET /view/url2Embed.json.php?url=https://example.com/video.mp4
   ```
   Copy `playLink`.
2. Decrypt without auth:
   ```
   POST /plugin/API/get.json.php?APIName=decryptString
   Content-Type: application/x-www-form-urlencoded

   string=<playLink ciphertext>
   ```
   Response contains the plaintext JSON (videoLink, title, users_id, etc.).

### Impact
- Any encrypted payload produced by the platform can be decrypted by anyone.
- Leaks tokens/links intended to be confidential; enables replay and tampering where secrecy was assumed.

### Mitigation
- Require API secret or authenticated/authorized user for `decryptString`, or remove the endpoint.
- Prefer one-way signatures (HMAC) instead of exposing generic decryption.
- Rotate encryption keys/salts after patch to invalidate exposed ciphertexts.
GitHub Security Advisory: GHSA-gv7f-w92j-383q
Package: dreamfactory/df-core (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.0.4
Patched in: 1.0.4

Summary: DreamFactory has a directory traversal

Details:
An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.
GitHub Security Advisory: GHSA-3527-qv2q-pfvx
Package: league/commonmark (COMPOSER)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.5.0, < 2.7.0
Patched in: 2.7.0

Summary: league/commonmark contains a XSS vulnerability in Attributes extension

Details:
### Summary
Cross-site scripting (XSS) vulnerability in the [Attributes extension](https://commonmark.thephpleague.com/extensions/attributes/) of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML.

### Details

The league/commonmark library provides configuration options such as `html_input: 'strip'` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces.

As a result, even with the secure configuration shown above, an attacker can inject dangerous attributes into applications using this extension via a payload such as:

```md
![](){onerror=alert(1)}
```

Which results in the following HTML:

```html
<p><img onerror="alert(1)" src="" alt="" /></p>
```

Which causes the JS to execute immediately on page load.

### Patches

Version 2.7.0 contains three changes to prevent this XSS attack vector:

- All attributes starting with `on` are considered unsafe and blocked by default
- [Support for an explicit allowlist of allowed HTML attributes](https://commonmark.thephpleague.com/2.7/extensions/attributes/#configuration)
- Manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option

### Workarounds

If upgrading is not feasible, please consider:

- Disabling the `AttributesExtension` for untrusted users
- [Filtering the rendered HTML through a library like HTMLPurifier](https://commonmark.thephpleague.com/security/#additional-filtering)
GitHub Security Advisory: GHSA-4v6x-c7xx-hw9f
Package: league/commonmark (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, <= 2.8.0
Patched in: 2.8.1

Summary: CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names

Details:
### Impact

The `DisallowedRawHtml` extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing `>`. For example, `<script\n>` would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input.

All applications using the `DisallowedRawHtml` extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected.

### Patches

Fixed in 2.8.1. The regex character class `[ \/>]` was changed to `[\s\/>]` to match all whitespace characters that browsers accept as valid tag name terminators.

### Workarounds

- Set the `html_input` configuration option to `'escape'` or `'strip'` to disable all raw HTML, though this is a broader restriction than the `DisallowedRawHtml` extension provides.
- Pass the rendered HTML through a dedicated HTML sanitizer before serving it to users ([always recommended](https://commonmark.thephpleague.com/2.x/security/#additional-filtering))
GitHub Security Advisory: GHSA-hh8v-hgvp-g3f5
Package: league/commonmark (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-185: Incorrect Regular Expression, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.3.0, <= 2.8.1
Patched in: 2.8.2

Summary: league/commonmark has an embed extension allowed_domains bypass

Details:
### Impact

The `DomainFilteringAdapter` in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like `youtube.com.evil` passes the allowlist check when `youtube.com` is an allowed domain.

This enables two attack vectors:

- **SSRF**: The `OscaroteroEmbedAdapter` makes server-side HTTP requests to the embed URL via the `embed/embed` library. A bypassed domain filter causes the server to make outbound requests to an attacker-controlled host, potentially probing internal services or exfiltrating request metadata.
- **XSS**: `EmbedRenderer` outputs the oEmbed response HTML directly into the page with no sanitization. An attacker controlling the bypassed domain can return arbitrary HTML/JavaScript in their oEmbed response, which is rendered verbatim.

Any application using the `Embed` extension and relying on `allowed_domains` to restrict domains when processing untrusted Markdown input is affected.

### Patches

This has been patched in version **2.8.2**. The fix replaces the regex-based domain check with explicit hostname parsing using `parse_url()`, ensuring exact domain and subdomain matching only.

### Workarounds

- Disable the `Embed` extension, or restrict its use to trusted users
- Provide your own domain-filtering implementation of `EmbedAdapterInterface`
- Enable a [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) and outbound firewall restrictions
GitHub Security Advisory: GHSA-jxq9-79vj-rgvw
Package: statamic/cms (COMPOSER)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Vulnerable versions: >= 6.0.0-alpha.1, < 6.7.1
Patched in: 6.7.1

Summary: Statamic is vulnerable to account takeover via password reset link injection

Details:
## Impact

An attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf.

The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset.

## Patches

This has been fixed in 6.7.1 and 5.73.10.

Note that a follow-up report showed the original 6.3.3 fix to be insufficient. The 5.73.10 fix was sufficient.
GitHub Security Advisory: GHSA-g9w4-m5fx-x3wv
Package: yoast/duplicate-post (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 4.5
Patched in: 4.6

Summary: Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite

Details:
The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() and republish_request() functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate any post on the site including private, draft, and trashed posts they shouldn't have access to. Additionally, attackers with Author-level access and above can use the Rewrite & Republish feature to overwrite any published post with their own content.