deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-px7x-gq96-rmp5
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 25.0
Patched in: unpatched

Summary: AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

Details:
### Summary

`/objects/encryptPass.json.php` exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes.

### Details

**File:** `objects/encryptPass.json.php`

```php
$obj->password = @$_REQUEST['pass'];
$obj->encrypted[CREDENTIAL_REDACTED]($obj->password);
echo json_encode($obj);
```

No authentication is required. The `encryptPassword()` function in `objects/functions.php` (line ~2101) uses:

```php
function encryptPassword($password, $noSalt = false) {
    if (!empty($advancedCustomUser->encryptPasswordsWithSalt) && !empty($global['salt']) && empty($noSalt)) {
        $password .= $global['salt'];
    }
    return md5(hash('whirlpool', sha1($password)));
}
```

By default, salt is NOT enabled (`encryptPasswordsWithSalt` is off), making the hash deterministic and identical to what's stored in the database.

### PoC

```bash
# Get the hash for any password
curl 'https://TARGET/objects/encryptPass.json.php?pass=admin123'
# Response: {"password":"admin123","encryptedPassword":"<hash>"}

# Build a rainbow table for common passwords
for pass in $(cat rockyou-top1000.txt); do
  curl -s "https://TARGET/objects/encryptPass.json.php?pass=$pass"
done
```

If an attacker obtains password hashes from the database (via SQL injection, backup exposure, etc.), they can instantly crack them by comparing against pre-computed hashes from this endpoint.

### Impact

**Password Cracking Acceleration** — This endpoint eliminates the need for an attacker to reverse-engineer the hashing algorithm. Combined with the weak hash chain (md5+whirlpool+sha1, no salt by default), an attacker with access to database hashes can crack passwords extremely quickly.

Additionally, this reveals whether salt is enabled and the exact hashing implementation, which is sensitive cryptographic configuration.
GitHub Security Advisory: GHSA-7x5c-vfhj-9628
Package: cockpit-hq/cockpit (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 2.13.5
Patched in: 2.13.5

Summary: Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() 

Details:
### Impact

This is a SQL Injection vulnerability in the MongoLite Aggregation Optimizer.

Any Cockpit CMS instance running version **2.13.4 or earlier** with API access enabled
is potentially affected.

**Who is impacted:**
- Any deployment where the `/api/content/aggregate/{model}` endpoint is publicly
  accessible or reachable by untrusted users.
- Attackers in possession of a **valid read-only API key** (the lowest privilege level)
  can exploit this vulnerability — no admin access is required.

**What an attacker can do:**
- Inject arbitrary SQL via unsanitized field names in aggregation queries.
- Bypass the `_state=1` published-content filter to access unpublished or restricted content.
- Extract unauthorized data from the underlying SQLite content database.

**Confidentiality impact is High.** Integrity and availability are not directly affected
by this vulnerability.

### Patches

This vulnerability has been **patched in version 2.13.5**.

All users running Cockpit CMS version **2.13.4 or earlier** are strongly advised to
upgrade to **2.13.5 or later** immediately.

- https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.13.5

The fix applies the same field-name sanitization introduced in v2.13.3 for `toJsonPath()`
to the `toJsonExtractRaw()` method in `lib/MongoLite/Aggregation/Optimizer.php`,
closing the injection vector in the Aggregation Optimizer.
GitHub Security Advisory: GHSA-q6fm-p73f-x862
Package: craftcms/azure-blob (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 2.0.0-beta.1, <= 2.1.0
Patched in: 2.1.1

Summary: Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability

Details:
Unauthenticated users can view a list of buckets the plugin has access to.

The `DefaultController->actionLoadContainerData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Because Azure can return sensitive data in error messages, additional attack vectors are also exposed.

Users should update to version 2.1.1 of the plugin to mitigate the issue.
GitHub Security Advisory: GHSA-67cr-jmh8-4jpq
Package: craftcms/google-cloud (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.0.0-beta.1, <= 2.2.0
Patched in: 2.2.1

Summary: Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability

Details:
Unauthenticated users can view a list of buckets the plugin has access to.

The `DefaultController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Users should update to version 2.2.1 of the plugin to mitigate the issue.
GitHub Security Advisory: GHSA-hwj7-4vgc-j3v9
Package: craftcms/aws-s3 (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 2.0.2, <= 2.2.4
Patched in: 2.2.5

Summary: Amazon S3 for Craft CMS has an Information Disclosure vulnerability

Details:
Unauthenticated users can view a list of buckets the plugin has access to.

The `BucketsController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Users should update to version 2.2.5 of the plugin to mitigate the issue.
GitHub Security Advisory: GHSA-4484-8v2f-5748
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Vulnerable versions: >= 5.0.0-RC1, <= 5.9.10
Patched in: 5.9.11

Summary: Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

Details:
The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 (commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `ElementIndexesController` and `FieldsController`.

You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.

An attacker can use the same gadget chain from the original advisory to achieve RCE.

Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue.
GitHub Security Advisory: GHSA-4484-8v2f-5748
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Vulnerable versions: >= 4.0.0-RC1, <= 4.17.4
Patched in: 4.17.5

Summary: Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

Details:
The fix for https://github.com/advisories/GHSA-7jx7-3846-m7w7 (commit https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `ElementIndexesController` and `FieldsController`.

You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.

An attacker can use the same gadget chain from the original advisory to achieve RCE.

Users should update to Craft 4.17.5 and 5.9.11 to mitigate the issue.
GitHub Security Advisory: GHSA-qx2q-q59v-wf3j
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Vulnerable versions: >= 5.6.0, <= 5.9.10
Patched in: 5.9.11

Summary: Craft CMS vulnerable to behavior injection RCE via EntryTypesController

Details:
The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f0b80b507be1c862a2ec942eaacb353748) only patched `src/services/Fields.php`, but the same vulnerable pattern exists in `EntryTypesController::actionApplyOverrideSettings()`.

In `src/controllers/EntryTypesController.php` lines 381-387:

```php
$settingsStr = $this->request->getBodyParam('settings');
parse_str($settingsStr, $postedSettings);
$settingsNamespace = $this->request->getRequiredBodyParam('settingsNamespace');
$settings = array_filter(ArrayHelper::getValue($postedSettings, $settingsNamespace, []));

if (!empty($settings)) {
    Craft::configure($entryType, $settings);
```

The `$settings` array from `parse_str` is passed directly to `Craft::configure()` without `Component::cleanseConfig()`. This allows injecting Yii2 behavior/event handlers via `as ` or `on ` prefixed keys, the same attack vector as the original advisory.

You need Craft control panel administrator permissions, and `allowAdminChanges` must be enabled for this to work.

An attacker can use the same gadget chain from the original advisory to achieve RCE.

Users should update to Craft 5.9.11 to mitigate the issue.
GitHub Security Advisory: GHSA-472v-j2g4-g9h2
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 5.0.0-RC1, <= 5.9.10
Patched in: 5.9.11

Summary: Craft CMS has a Path Traversal Vulnerability in AssetsController

Details:
The `AssetsController->replaceFile()` method has a `targetFilename` body parameter that is used unsanitized in a `deleteFile()` call before `Assets::prepareAssetName()` is applied on save. This allows an authenticated user with `replaceFiles` permission to delete arbitrary files within the same filesystem root by injecting `../` path traversal sequences into the filename.

This could allow an authenticated user with `replaceFiles` permission on one volume to delete files in other folders/volumes that share the same filesystem root.

This only affects local filesystems.

Users should update to Craft 4.17.5 or 5.9.11 to mitigate the issue.
GitHub Security Advisory: GHSA-472v-j2g4-g9h2
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.0.0-RC1, <= 4.17.4
Patched in: 4.17.5

Summary: Craft CMS has a Path Traversal Vulnerability in AssetsController

Details:
The `AssetsController->replaceFile()` method has a `targetFilename` body parameter that is used unsanitized in a `deleteFile()` call before `Assets::prepareAssetName()` is applied on save. This allows an authenticated user with `replaceFiles` permission to delete arbitrary files within the same filesystem root by injecting `../` path traversal sequences into the filename.

This could allow an authenticated user with `replaceFiles` permission on one volume to delete files in other folders/volumes that share the same filesystem root.

This only affects local filesystems.

Users should update to Craft 4.17.5 or 5.9.11 to mitigate the issue.
GitHub Security Advisory: GHSA-8wg7-wm29-2rvg
Package: craftcms/webhooks (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: >= 3.0.0, < 3.2.0
Patched in: 3.2.0

Summary: RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin

Details:
The Webhooks plugin renders user-supplied template content through Twig’s `renderString()` function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions.

This is possible even if `allowAdminChanges` is set to `false`.

Affected users should update to version 3.2.0 to mitigate the issue.
GitHub Security Advisory: GHSA-hcch-w73c-jp4m
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.0, < 6.6.2
Patched in: 6.6.2

Summary: Statamic vulnerable to privilege escalation via stored cross-site scripting

Details:
### Impact

Stored XSS in the control panel color mode preference allows authenticated users with control panel access to inject malicious JavaScript that executes when a higher-privileged user impersonates their account.

### Patches

This has been fixed in 6.6.2.
GitHub Security Advisory: GHSA-pgpf-m8m4-6cg6
Package: winter/wn-backend-module (COMPOSER)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-284: Improper Access Control, CWE-639: Authorization Bypass Through User-Controlled Key, CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: < 1.0.477
Patched in: 1.0.477

Summary: Winter vulnerable to privilege escalation by authenticated backend users

Details:
## Impact
Affected versions of Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in.

To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access.

The Winter CMS maintainers strongly recommend that all Winter CMS sites that have any reliance on the roles & permissions system to update immediately. Security fixes have been backported to all major versions of Winter (1.0, 1.1, and 1.2).

## Patches
Multiple fixes and defence in depth has been applied to prevent current and future privilege escalation attacks at the lowest level possible.

This security issue has been fixed as of https://wintercms.com/releases/v1.0.477, https://wintercms.com/releases/v1.1.12, https://wintercms.com/releases/v1.2.12.

## Workarounds
If you cannot upgrade, you may apply the changes from the releases to your Winter CMS installation manually to resolve this issue.
GitHub Security Advisory: GHSA-pgpf-m8m4-6cg6
Package: winter/wn-backend-module (COMPOSER)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-284: Improper Access Control, CWE-639: Authorization Bypass Through User-Controlled Key, CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: >= 1.1.0, < 1.1.12
Patched in: 1.1.12

Summary: Winter vulnerable to privilege escalation by authenticated backend users

Details:
## Impact
Affected versions of Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in.

To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access.

The Winter CMS maintainers strongly recommend that all Winter CMS sites that have any reliance on the roles & permissions system to update immediately. Security fixes have been backported to all major versions of Winter (1.0, 1.1, and 1.2).

## Patches
Multiple fixes and defence in depth has been applied to prevent current and future privilege escalation attacks at the lowest level possible.

This security issue has been fixed as of https://wintercms.com/releases/v1.0.477, https://wintercms.com/releases/v1.1.12, https://wintercms.com/releases/v1.2.12.

## Workarounds
If you cannot upgrade, you may apply the changes from the releases to your Winter CMS installation manually to resolve this issue.
GitHub Security Advisory: GHSA-pgpf-m8m4-6cg6
Package: winter/wn-backend-module (COMPOSER)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-284: Improper Access Control, CWE-639: Authorization Bypass Through User-Controlled Key, CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: >= 1.2.0, < 1.2.12
Patched in: 1.2.12

Summary: Winter vulnerable to privilege escalation by authenticated backend users

Details:
## Impact
Affected versions of Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in.

To actively exploit this security issue, an attacker would need access to the Backend with a user account with any level of access.

The Winter CMS maintainers strongly recommend that all Winter CMS sites that have any reliance on the roles & permissions system to update immediately. Security fixes have been backported to all major versions of Winter (1.0, 1.1, and 1.2).

## Patches
Multiple fixes and defence in depth has been applied to prevent current and future privilege escalation attacks at the lowest level possible.

This security issue has been fixed as of https://wintercms.com/releases/v1.0.477, https://wintercms.com/releases/v1.1.12, https://wintercms.com/releases/v1.2.12.

## Workarounds
If you cannot upgrade, you may apply the changes from the releases to your Winter CMS installation manually to resolve this issue.
GitHub Security Advisory: GHSA-rccq-2fxq-7x3h
Package: limesurvey/limesurvey (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 6.15.4
Patched in: 6.15.4

Summary: LimeSurvey is vulnerable to SQL injection

Details:
SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.
GitHub Security Advisory: GHSA-7vvp-j573-5584
Package: shopware/platform (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 6.6.10.15
Patched in: 6.6.10.15

Summary: Shopware: Unauthenticated data extraction possible through store-api.order endpoint

Details:
### Summary

An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the `deepLinkCode` support on the `store-api.order` endpoint.

### Details

#### Data Exposure

Depending on the order payload configuration, attackers may retrieve:
- Customer names
- Billing address
- Shipping address
- Email addresses
- Ordered products
- Order values
- Order numbers
- Order dates
- Payment method information
- Shipping method information
- More customs, depending on the given associations in the request

#### Security Impact

This vulnerability allows:
- Unauthorized access to foreign customer order data
- Mass enumeration of recent orders
- Potential scraping of customer personal information

#### Limitation

No limitation, but only orders from the past 30 days are checked for changeable means of payment (unrelated).

### Impact

The code is present since ~2021. Likely every version since then is impacted for every store.
GitHub Security Advisory: GHSA-7vvp-j573-5584
Package: shopware/platform (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 6.7.0.0, < 6.7.8.1
Patched in: 6.7.8.1

Summary: Shopware: Unauthenticated data extraction possible through store-api.order endpoint

Details:
### Summary

An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the `deepLinkCode` support on the `store-api.order` endpoint.

### Details

#### Data Exposure

Depending on the order payload configuration, attackers may retrieve:
- Customer names
- Billing address
- Shipping address
- Email addresses
- Ordered products
- Order values
- Order numbers
- Order dates
- Payment method information
- Shipping method information
- More customs, depending on the given associations in the request

#### Security Impact

This vulnerability allows:
- Unauthorized access to foreign customer order data
- Mass enumeration of recent orders
- Potential scraping of customer personal information

#### Limitation

No limitation, but only orders from the past 30 days are checked for changeable means of payment (unrelated).

### Impact

The code is present since ~2021. Likely every version since then is impacted for every store.
GitHub Security Advisory: GHSA-7vvp-j573-5584
Package: shopware/core (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 6.6.10.15
Patched in: 6.6.10.15

Summary: Shopware: Unauthenticated data extraction possible through store-api.order endpoint

Details:
### Summary

An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the `deepLinkCode` support on the `store-api.order` endpoint.

### Details

#### Data Exposure

Depending on the order payload configuration, attackers may retrieve:
- Customer names
- Billing address
- Shipping address
- Email addresses
- Ordered products
- Order values
- Order numbers
- Order dates
- Payment method information
- Shipping method information
- More customs, depending on the given associations in the request

#### Security Impact

This vulnerability allows:
- Unauthorized access to foreign customer order data
- Mass enumeration of recent orders
- Potential scraping of customer personal information

#### Limitation

No limitation, but only orders from the past 30 days are checked for changeable means of payment (unrelated).

### Impact

The code is present since ~2021. Likely every version since then is impacted for every store.
GitHub Security Advisory: GHSA-7vvp-j573-5584
Package: shopware/core (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 6.7.0.0, < 6.7.8.1
Patched in: 6.7.8.1

Summary: Shopware: Unauthenticated data extraction possible through store-api.order endpoint

Details:
### Summary

An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the `deepLinkCode` support on the `store-api.order` endpoint.

### Details

#### Data Exposure

Depending on the order payload configuration, attackers may retrieve:
- Customer names
- Billing address
- Shipping address
- Email addresses
- Ordered products
- Order values
- Order numbers
- Order dates
- Payment method information
- Shipping method information
- More customs, depending on the given associations in the request

#### Security Impact

This vulnerability allows:
- Unauthorized access to foreign customer order data
- Mass enumeration of recent orders
- Potential scraping of customer personal information

#### Limitation

No limitation, but only orders from the past 30 days are checked for changeable means of payment (unrelated).

### Impact

The code is present since ~2021. Likely every version since then is impacted for every store.