deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7pgw-q3qp-6pgq
Package: universal-omega/dynamic-page-list3 (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: < 3.6.4
Patched in: 3.6.4

Summary: DynamicPageList3 vulnerability exposes hidden/suppressed usernames

Details:
### Summary
Several `#dpl` parameters can leak usernames that have been hidden using revision deletion, suppression, or the `hideuser` block flag.

### Details
The parameters `adduser`, `addauthor`, and `addlasteditor` output the page creator or last editor using the `%USER%` placeholder. These display the actual username, even when that name has been hidden using revision deletion, suppression (oversight), or `hideuser`.

The `%CONTRIBUTOR%` placeholder, used with `addcontribution`, behaves similarly and also reveals hidden usernames.

In addition, the following parameters can expose suppressed usernames when combined with `%USER%` or similar output placeholders:
- `lastrevisionbefore`
- `allrevisionsbefore`
- `firstrevisionsince`
- `allrevisionssince`

These parameters reference specific revisions and allow output of user-related metadata. If a username has been hidden from those revisions, it may still appear in the output.

Further, the parameters `createdby`, `notcreatedby`, `modifiedby`, `notmodifiedby`, `lastmodifiedby`, and `notlastmodifiedby` accept usernames as input. When the correct (suppressed) username is used, the query may return matching pages or edits. This can reveal the presence and association of a hidden identity, even if not displayed directly. However, this is a more indirect exposure than the output parameters mentioned above.

### Proof of Concept

1. Create a page while logged in as a user.
2. Revision delete or suppress the username from the page history.
3. Use a DPL query with one of the affected parameters.
4. The output reveals the hidden username.

#### Example

The following query reveals the suppressed username `Example user`:

```wikitext
{{#dpl:
| title = File:Example.png
| addauthor = true
| format = ,%USER%,,
}}
```

Similar behavior occurs using parameters like `lastrevisionbefore` with `%USER%` in the `format` string.

### Impact
This issue causes the exposure of usernames that were intentionally hidden by administrators. It directly undermines revision deletion, user suppression, and block-related privacy measures. In some cases, usernames can be revealed both directly through output and indirectly through query behavior.
GitHub Security Advisory: GHSA-hcgh-r5gq-6qc2
Package: microweber/microweber (COMPOSER)
Severity: LOW (CVSS 3.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.0.19
Patched in: unpatched

Summary: Microweber vulnerable to XSS attack due to insure `group` component in its Settings handler

Details:
A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/settings/group/website_group/index.php of the component Settings Handler. The manipulation of the argument group leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-p9qc-8jjx-g8cg
Package: bolt/bolt (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 3.7.0
Patched in: unpatched

Summary: Bolt CMS vulnerable to authenticated remote code execution

Details:
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file.

NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.
GitHub Security Advisory: GHSA-j4rj-fgcq-wmqp
Package: cockpit-hq/cockpit (COMPOSER)
Severity: MODERATE (CVSS 3.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.11.4
Patched in: 2.11.4

Summary: Cockpit - Content Platform vulnerable to XSS through name or email argument names

Details:
A vulnerability was found in Cockpit versions up to 2.11.3. This issue affects some unknown processing instances of the file /system/users/save. The manipulation of the arguments "name" or "email" leads to cross-site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 will address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted accordingly. A patch and new release were made available very quickly.
GitHub Security Advisory: GHSA-p85q-mww9-gwqf
Package: starcitizentools/short-description (COMPOSER)
Severity: HIGH (CVSS 8.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.0.1
Patched in: 4.0.1

Summary: Citizen Short Description stored XSS vulnerability through wikitext

Details:
### Summary
Short descriptions are not properly sanitized by the ShortDescription before being inserted as HTML using `mw.util.addSubtitle`, allowing any user to insert arbitrary HTML into the DOM by editing a page.

### Details
The description provided by the user via the `{{SHORTDESC:}}` parser function is insufficiently sanitized by the `sanitize()` function, as html entities are decoded:
https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/includes/Hooks/ParserHooks.php#L147-L159
Via JS, the short description is then passed to `mw.util.addSubtitle`, which inserts it as raw HTML:
https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/modules/ext.shortDescription.js#L8
https://github.com/wikimedia/mediawiki/blob/96372101b3c579d9992e8a31a3ccd90a937cac47/resources/src/mediawiki.util/util.js#L552-L563

### PoC
1. Enable ShortDescription
2. Make sure `$wgShortDescriptionEnableTagline` is set to `true` (this is the default)
3. Create a page and insert the following wikitext: `{{SHORTDESC:&lt;img src="" onerror="alert('shortdescription xss')"&gt;}}`
4. Visit the page

![image](https://github.com/user-attachments/assets/8e467f28-3bb5-4462-b28b-14e145be743f)
![image](https://github.com/user-attachments/assets/39e132c3-6a92-4f24-8aef-b915e8560f63)


### Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
GitHub Security Advisory: GHSA-prmv-7r8c-794g
Package: starcitizentools/citizen-skin (COMPOSER)
Severity: HIGH (CVSS 8.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.9.4, < 3.4.0
Patched in: 3.4.0

Summary: Citizen vulnerable to Stored XSS through short descriptions

Details:
### Summary
Short descriptions set via the [ShortDescription extension](https://www.mediawiki.org/wiki/Extension:ShortDescription) are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page.

### Details
The `shortdesc` property, which contains unsanitized user input, is retrieved from the OutputPage and returned as the tagline:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L249-L251
The tagline is then provided to the template data:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L270-L275
The template then inserts the tagline into raw HTML without doing any escaping:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/templates/PageHeading.mustache#L12

### PoC
1. Enable Citizen and ShortDescription
2. Add `{{SHORTDESC:&lt;img src="" onerror="alert('citizen shortdescription xss')"&gt;}}` to a page
3. Visit the page
![image](https://github.com/user-attachments/assets/d45f3626-c5eb-4477-86af-d15d3a1edb96)
![image](https://github.com/user-attachments/assets/84a8c447-d441-4bd6-b6d6-48e504527c4e)


### Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
GitHub Security Advisory: GHSA-j64v-xh5w-8hqj
Package: microweber/microweber (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.2.11
Patched in: 1.2.11

Summary: Microweber CMS API has authenticated local file inclusion vulnerability

Details:
An authenticated local file inclusion vulnerability exists in Microweber CMS versions < 1.2.11 through misuse of the backup management API. Authenticated users can abuse the /api/BackupV2/upload and /api/BackupV2/download endpoints to read arbitrary files from the underlying filesystem. By specifying an absolute file path in the src parameter of the upload request, the server may relocate or delete the target file depending on the web service user’s privileges. The corresponding download endpoint can then be used to retrieve the file contents, effectively enabling local file disclosure. This behavior stems from insufficient validation of user-supplied paths and inadequate restrictions on file access and backup logic.
GitHub Security Advisory: GHSA-jfj7-249r-7j2m
Package: starcitizentools/tabber-neue (COMPOSER)
Severity: HIGH (CVSS 8.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 3.0.0, < 3.1.1
Patched in: 3.1.1

Summary: TabberNeue vulnerable to Stored XSS through wikitext

Details:
### Summary
Arbitrary HTML can be inserted into the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag.

### Details

The `args` provided within the wikitext as attributes to the `<tabber>` tag are passed to the TabberComponentTabs class:
https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76

In TabberComponentTabs, the attributes are validated before being supplied to the Tabs template.
https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31
However, the validation is insufficient.
What `Sanitizer::validateTagAttributes` does is call `validateAttributes`, which
```
	 * - Discards attributes not on the given list
	 * - Unsafe style attributes are discarded
	 * - Invalid id attributes are re-encoded
```
However, the attribute values are expected to be escaped when inserted into HTML.

The attribute values are then inserted into HTML without being escaped:
https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1

### PoC
#### XSS through attributes:
1. Go to Special:ExpandTemplates and insert the following wikitext:
```
<tabber class='test123" onmouseenter="alert(1)"'>
|-|First Tab Title=
First tab content goes here.
</tabber>
```
2. Press "OK"
3. Hover over the tabber

![image](https://github.com/user-attachments/assets/bb65a587-e277-4936-b9f9-400ad7c39040)


#### XSS through script tags:
1. Go to Special:ExpandTemplates and insert the following wikitext:
```
<tabber class='test123"&gt;&lt;script&gt;alert(2)&lt;/script&gt;'>
|-|First Tab Title=
First tab content goes here.
</tabber>
```
2. Press "OK"
![image](https://github.com/user-attachments/assets/a51ede5c-f9a0-49be-875e-37d30a083721)

### Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
GitHub Security Advisory: GHSA-277f-37gw-9gmq
Package: billz/raspap-webgui (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-23: Relative Path Traversal
Vulnerable versions: < 3.3.6
Patched in: 3.3.6

Summary: raspap-webgui has a Directory Traversal vulnerability

Details:
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell execution.
GitHub Security Advisory: GHSA-cgvv-3455-824j
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 3.0.0, <= 3.11.18
Patched in: 4.0.0

Summary: Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter

Details:
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
GitHub Security Advisory: GHSA-j934-vjh5-vf9r
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magneto contains stored XSS vulnerability

Details:
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-j934-vjh5-vf9r
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p11
Patched in: 2.4.6-p11

Summary: Magneto contains stored XSS vulnerability

Details:
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-j934-vjh5-vf9r
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magneto contains stored XSS vulnerability

Details:
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-j934-vjh5-vf9r
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.8
Patched in: unpatched

Summary: Magneto contains stored XSS vulnerability

Details:
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-j934-vjh5-vf9r
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magneto contains stored XSS vulnerability

Details:
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-j934-vjh5-vf9r
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.4.5-p13
Patched in: 2.4.5-p13

Summary: Magneto contains stored XSS vulnerability

Details:
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-j934-vjh5-vf9r
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p6
Patched in: 2.4.7-p6

Summary: Magneto contains stored XSS vulnerability

Details:
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-j934-vjh5-vf9r
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.8-beta1, < 2.4.8-p1
Patched in: 2.4.8-p1

Summary: Magneto contains stored XSS vulnerability

Details:
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
GitHub Security Advisory: GHSA-pr6q-g5gv-qgr7
Package: geshi/geshi (COMPOSER)
Severity: MODERATE (CVSS 3.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.0.9.1
Patched in: unpatched

Summary: GeSHi XSS possible in the get_var function of /contrib/cssgen.php

Details:
A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function get_var of the file /contrib/cssgen.php of the component CSS Handler. The manipulation of the argument default-styles/keywords-1/keywords-2/keywords-3/keywords-4/comments leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
GitHub Security Advisory: GHSA-24wv-6c99-f843
Package: pterodactyl/panel (COMPOSER)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 1.11.10
Patched in: 1.11.11

Summary: Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Details:
## Impact

Using the `/locales/locale.json` with the `locale` and `namespace` query parameters, a malicious actor is able to execute arbitrary code, without being authenticated.

With the ability to execute arbitrary code, this vulnerability can be exploited in an infinite number of ways.  It could be used to gain access to the Panel's server, read credentials from the Panel's config (`.env` or otherwise), extract sensitive information from the database (such as user details [username, email, first and last name, hashed password, ip addresses, etc]), access files of servers managed by the panel, etc.

## Patches

This vulnerability was patched by https://github.com/pterodactyl/panel/commit/24c82b0e335fb5d7a844226b08abf9f176e592f0 and was released under the [`v1.11.11`](https://github.com/pterodactyl/panel/releases/tag/v1.11.11) tag without any other code modifications compared to `v1.11.10`.

For those who need to patch their installations in-place or apply it on top of other code modifications, a patch file can be retrieved from <https://github.com/pterodactyl/panel/commit/24c82b0e335fb5d7a844226b08abf9f176e592f0.patch> and applied using `git apply`.

## Workarounds

Other than patching the software, there is no workaround in this software.  Disabling the `/locales/locale.json` endpoint at the webserver level is possible, but would break the localization feature wherever it is used.

The only other workaround relies on an external Web Application Firewall (WAF), such as Cloudflare's WAF with their default ruleset (requires Pro plan or above, Free doesn't have the proper ruleset) to mitigate this attack.

Updating to [`v1.11.11`](https://github.com/pterodactyl/panel/releases/tag/v1.11.11) or manually patching the software are the only recommended ways to completely mitigate this vulnerability.

## User Notice

Shortly after the [`v1.11.11`](https://github.com/pterodactyl/panel/releases/tag/v1.11.11)release and it's announcement, security researchers and malicious actors have been attempting to exploit this vulnerability.  While there hasn't been any official confirmations of breaches or successful exploits of the vulnerability in the wild, it is only a matter of time for those who remain on unpatched versions without any workarounds in place.

The scope of this vulnerability cannot be fully described, anything is possible.  It is of utmost importance that anyone running a vulnerable version of this software, patch it or update to the latest available version **immediately**.
GitHub Security Advisory: GHSA-49rr-34j5-r8mw
Package: juzaweb/cms (COMPOSER)
Severity: MODERATE (CVSS 3.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 3.4.2
Patched in: unpatched

Summary: juzaweb CMS allows cross-site scripting by uploading an SVG file

Details:
A vulnerability classified as problematic was found in juzaweb CMS up to 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/file-manager/upload of the component Profile Page. The manipulation of the argument Upload leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.