deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-j2g6-8rvg-7mf6
Package: roundcube/roundcubemail (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-669: Incorrect Resource Transfer Between Spheres
Vulnerable versions: >= 1.7-beta, < 1.7-rc5
Patched in: 1.7-rc5

Summary: Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message

Details:
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.
GitHub Security Advisory: GHSA-5hf6-crg4-fg59
Package: roundcube/roundcubemail (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-669: Incorrect Resource Transfer Between Spheres
Vulnerable versions: >= 1.7-beta, < 1.7-rc5
Patched in: 1.7-rc5

Summary: Roundcube: Bypass of remote image blocking via crafted BODY background attribute

Details:
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.
GitHub Security Advisory: GHSA-46pv-mj2g-93gh
Package: roundcube/roundcubemail (COMPOSER)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Vulnerable versions: >= 1.7-beta, < 1.7-rc5
Patched in: 1.7-rc5

Summary: Roundcube Webmail: Incorrect password comparison in the password plugin

Details:
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
GitHub Security Advisory: GHSA-vxg2-hhgr-37fx
Package: roundcube/roundcubemail (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-669: Incorrect Resource Transfer Between Spheres, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 1.7-beta, < 1.7-rc5
Patched in: 1.7-rc5

Summary: Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages

Details:
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.
GitHub Security Advisory: GHSA-x4q5-8j5g-hpjc
Package: roundcube/roundcubemail (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.7-beta, < 1.7-rc5
Patched in: 1.7-rc5

Summary: Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode

Details:
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
GitHub Security Advisory: GHSA-8jr8-v43g-5c57
Package: roundcube/roundcubemail (COMPOSER)
Severity: LOW (CVSS 3.1)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: >= 1.7-beta, < 1.7-rc5
Patched in: 1.7-rc5

Summary: Roundcube Webmail: Unsanitized IMAP SEARCH command arguments

Details:
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
GitHub Security Advisory: GHSA-rxj3-rrwm-pj4r
Package: roundcube/roundcubemail (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 1.7-beta, < 1.7-rc5
Patched in: 1.7-rc5

Summary: Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler

Details:
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
GitHub Security Advisory: GHSA-9m2v-hc5g-5jpv
Package: krayin/laravel-crm (COMPOSER)
Severity: LOW (CVSS 3.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.2.0
Patched in: unpatched

Summary: Krayin CRM is vulnerable to Cross-site Scripting (XSS)

Details:
A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/inbox.spec.ts of the component Activities Module/Notes Module. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is 73ed28d466bf14787fdb86a120c656a4af270153. To fix this issue, it is recommended to deploy a patch.
GitHub Security Advisory: GHSA-99j6-hj87-6fcf
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php

Details:
## Summary

The `plugin/CloneSite/client.log.php` endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces `User::isAdmin()`. The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

## Details

The entire file at `plugin/CloneSite/client.log.php`:

```php
<?php
include '../../videos/cache/clones/client.log';
```

No authentication check. The log file is populated by `cloneClient.json.php` which writes operational details during clone operations:

```php
// plugin/CloneSite/cloneClient.json.php:118
$log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file [$cmd]");
```

The `$cmd` variable contains wget commands with internal filesystem paths, and rsync command templates with SSH connection details (username, IP, port).

Compare with sibling endpoints:
- `plugin/CloneSite/index.php` checks `User::isAdmin()`
- `plugin/CloneSite/changeStatus.json.php` checks `User::isAdmin()`
- `plugin/CloneSite/clones.json.php` checks `User::isAdmin()`
- `plugin/CloneSite/delete.json.php` checks `User::isAdmin()`

## Proof of Concept

```bash
curl "https://your-avideo-instance.com/plugin/CloneSite/client.log.php"
```

If the CloneSite feature has been used, the response contains wget commands, filesystem paths, SSH metadata, and SQL dump file locations.

## Impact

Unauthenticated disclosure of internal infrastructure details that could aid targeted attacks against the clone source server.

## Recommended Fix

Add an admin authentication check at `plugin/CloneSite/client.log.php`, before the include:

```php
require_once '../../videos/configuration.php';
if (!User::isAdmin()) {
    http_response_code(403);
    die('Access denied');
}
```

---
*Found by [aisafe.io](https://aisafe.io)*
GitHub Security Advisory: GHSA-2vg4-rrx4-qcpq
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php

Details:
## Summary

The `plugin/API/check.ffmpeg.json.php` endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (`kill.ffmpeg.json.php`, `list.ffmpeg.json.php`, `ffmpeg.php`) require `User::isAdmin()`.

## Details

The entire file at `plugin/API/check.ffmpeg.json.php`:

```php
<?php
$configFile = __DIR__.'/../../videos/configuration.php';
require_once $configFile;
header('Content-Type: application/json');

$obj = testFFMPEGRemote();

die(json_encode($obj));
```

No `User::isAdmin()`, `User::isLogged()`, or any access control check exists.

Compare with sibling endpoints in the same directory:
- `kill.ffmpeg.json.php` checks `User::isAdmin()`
- `list.ffmpeg.json.php` checks `User::isAdmin()`

## Proof of Concept

```bash
curl "https://your-avideo-instance.com/plugin/API/check.ffmpeg.json.php"
```

Returns information about whether the platform uses a standalone FFmpeg server and its current reachability.

## Impact

Infrastructure reconnaissance revealing the encoding architecture. Limited direct impact but aids targeted attack planning.

## Recommended Fix

Add an admin authentication check at `plugin/API/check.ffmpeg.json.php:3`, after `require_once $configFile;`:

```php
if (!User::isAdmin()) {
    forbiddenPage('Admin only');
}
```

---
*Found by [aisafe.io](https://aisafe.io)*
GitHub Security Advisory: GHSA-hg8q-8wqr-35xx
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php

Details:
## Summary

The `install/test.php` diagnostic script has its CLI-only access guard disabled by commenting out the `die()` statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

## Details

The disabled guard at `install/test.php:5-7`:

```php
if (!isCommandLineInterface()) {
    //return die('Command Line only');
}
```

The script also enables verbose error reporting:

```php
error_reporting(E_ALL);
ini_set('display_errors', '1');
```

It then queries `VideoStatistic::getLastStatistics()` and outputs the result via `var_dump()`:

```php
$resp = VideoStatistic::getLastStatistics(getVideos_id(), User::getId());
var_dump($resp);
```

The `VideoStatistic` object contains: `ip` (viewer IP address), `session_id`, `user_agent`, `users_id`, and JSON metadata. The `display_errors=1` setting also leaks internal filesystem paths in any PHP warnings.

The `install/` directory is not restricted by `.htaccess` (it only disables directory listing via `Options -Indexes`) and no web server rules block access to individual PHP files in this directory.

## Proof of Concept

```bash
# Request viewer stats for video ID 1
curl "https://your-avideo-instance.com/install/test.php?videos_id=1"
```

Confirmed accessible on live AVideo instances (HTTP 200).

## Impact

Unauthenticated disclosure of viewer IP addresses (PII under GDPR), session identifiers, and user agents. The enabled `display_errors` also reveals internal server paths on errors.

- **CWE**: CWE-200 (Exposure of Sensitive Information)
- **Severity**: Low

## Recommended Fix

Uncomment the CLI guard at `install/test.php:6` to restore the intended access restriction:

```php
if (!isCommandLineInterface()) {
    return die('Command Line only');
}
```

---
*Found by [aisafe.io](https://aisafe.io)*
GitHub Security Advisory: GHSA-3v7m-qg4x-58h9
Package: wwbn/avideo (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php

Details:
## Summary

The BlockonomicsYPT plugin's `check.php` endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated `invoice.php` page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform.

## Details

In `plugin/BlockonomicsYPT/check.php` at lines 20-30, the endpoint accepts a Bitcoin address and returns the corresponding order data:

```php
$addr = $_GET['addr'];
$order = new BlockonomicsOrder(0);
$obj = $order->getFromAddressFromDb($addr);
die(json_encode($obj));
```

There is no authentication check. The endpoint does not verify that the requesting user is logged in, nor does it verify that the requesting user owns the order associated with the given address.

The response includes:
- User ID of the buyer
- Total payment value
- Currency
- BTC amounts (expected and received)
- Transaction ID
- Payment status

The `invoice.php` page that was designed to consume this endpoint does require authentication, but `check.php` itself does not inherit or enforce that requirement.

Bitcoin addresses are publicly queryable on the blockchain, so an attacker does not need to guess them. Addresses associated with the platform can be discovered by monitoring blockchain transactions to known platform wallets.

The BlockonomicsYPT plugin is tagged as deprecated by the AVideo project, but remains available and functional in current installations.

## Proof of Concept

```bash
# Query payment data for a known Bitcoin address without authentication
curl "https://your-avideo-instance.com/plugin/BlockonomicsYPT/check.php?addr=1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa"
```

Example response:

```json
{
  "id": 42,
  "users_id": 15,
  "value": "29.99",
  "currency": "USD",
  "btc_value": "0.00085",
  "btc_received": "0.00085",
  "txid": "abc123def456...",
  "status": "confirmed",
  "created": "2025-01-15 10:30:00"
}
```

No session cookie or API key is required.

## Impact

- Unauthenticated disclosure of payment order data including user IDs, amounts, and transaction details
- Bitcoin addresses are publicly discoverable on the blockchain
- Links on-chain transactions to specific platform user IDs
- Privacy violation for users who made cryptocurrency payments on the platform
- Plugin is deprecated but still functional in existing deployments

## Recommended Fix

Add an authentication check at `plugin/BlockonomicsYPT/check.php:17`:

```php
if (!User::isLogged()) {
    echo json_encode(["error" => "Login required"]);
    exit;
}
```

---
*Found by [aisafe.io](https://aisafe.io)*
GitHub Security Advisory: GHSA-4q27-4rrq-fx95
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php

Details:
**Severity:** Medium
**CWE:** CWE-352 (Cross-Site Request Forgery)

## Summary

The player skin configuration endpoint at `admin/playerUpdate.json.php` does not validate CSRF tokens. The `plugins` table is explicitly excluded from the ORM's domain-based security check via `ignoreTableSecurityCheck()`, removing the only other layer of defense. Combined with `SameSite=None` cookies, a cross-origin POST can modify the video player appearance on the entire platform.

## Details

In `admin/playerUpdate.json.php` at line 17, the player skin is set directly from POST data:

```php
$pluginDO->skin = $_POST['skin'];
```

No CSRF token is validated anywhere in the endpoint. Normally, the ORM layer performs a Referer/Origin domain check as a secondary defense against cross-origin writes. However, the `plugins` table is registered in `ignoreTableSecurityCheck()`, which explicitly bypasses this ORM-level protection for plugin configuration.

AVideo's session cookies are configured with `SameSite=None`, meaning the admin's authenticated session cookie is automatically included in cross-origin POST requests from any website.

An attacker can craft a page that, when visited by an authenticated admin, silently changes the player skin to any value, including potentially invalid or disruptive configurations.

## Proof of Concept

Host the following HTML on an attacker-controlled domain:

```html
<!DOCTYPE html>
<html>
<head><title>CSRF Player Skin</title></head>
<body>
<h1>Loading video...</h1>
<form id="csrf" method="POST"
      action="https://your-avideo-instance.com/admin/playerUpdate.json.php">
  <input type="hidden" name="skin" value="minimalist" />
</form>
<script>
  document.getElementById("csrf").submit();
</script>
</body>
</html>
```

When an authenticated admin visits this page, the platform's player skin is changed without their knowledge.

## Impact

- Platform-wide player appearance modification without admin consent
- Potential disruption of video playback if an invalid skin value is set
- The ORM security bypass via `ignoreTableSecurityCheck()` means there is no fallback protection
- Can be used as part of a broader defacement or social engineering attack

## Recommended Fix

Add CSRF token validation at `admin/playerUpdate.json.php`, before processing POST data:

```php
// admin/playerUpdate.json.php (before line 17)
if (!isGlobalTokenValid()) {
    die('{"error":"Invalid CSRF token"}');
}
```

---
*Found by [aisafe.io](https://aisafe.io)*
GitHub Security Advisory: GHSA-ghc5-95c2-vwcv
Package: auth0/symfony (COMPOSER)
Severity: HIGH (CVSS 8.2)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: >= 5.0.0, <= 5.7.0
Patched in: 5.8.0

Summary: Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption

Details:
### Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

### Am I Affected?
Consumers are affected if their application meets the following preconditions:
- It uses the Auth0 Symfony SDK, versions between 5.0.0 and 5.7.0
- Auth0 Symfony SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

### Resolution
Upgrade Auth0/symfony-auth0 to version 5.8.0 or greater.
GitHub Security Advisory: GHSA-vfpx-q664-h93m
Package: auth0/wordpress (COMPOSER)
Severity: HIGH (CVSS 8.2)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: >= 5.0.0-BETA0, <= 5.5.0
Patched in: 5.6.0

Summary: Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption

Details:
### Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

### Am I Affected?
Consumers are affected if their application meets the following preconditions:
- It is using the Auth0 WordPress Plugin, versions between 5.0.0-BETA0 and 5.5.0
- Auth0 WordPress plugin using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

### Resolution
Upgrade Auth0/wordpress to version 5.6.0 or greater.
GitHub Security Advisory: GHSA-fmg6-246m-9g2v
Package: auth0/login (COMPOSER)
Severity: HIGH (CVSS 8.2)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: >= 7.0.0, <= 7.20.0
Patched in: 7.21.0

Summary: Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption

Details:
### Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

### Am I Affected?
You are affected if you meet the following preconditions:

- Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
- Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.


### Resolution
Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.
GitHub Security Advisory: GHSA-w3wc-44p4-m4j7
Package: auth0/auth0-php (COMPOSER)
Severity: HIGH (CVSS 8.2)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: >= 8.0.0, <= 8.18.0
Patched in: 8.19.0

Summary: Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption

Details:
### Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

### Am I Affected?
Consumers are affected if their application meets the following preconditions:
- Their application is using the Auth0-PHP SDK, versions between 8.0.0 and 8.18.0
- Their application is using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK:
    - Auth0/symfony,
    - Auth0/laravel0-auth0, or
    - Auth0/wordpress

### Resolution
Upgrade Auth0/Auth0-PHP to version 8.19.0 or greater.
GitHub Security Advisory: GHSA-5724-x3rh-5qqq
Package: yeswiki/yeswiki (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.6.0
Patched in: 4.6.0

Summary: YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities

Details:
### Summary

Multiple **reflected Cross-site Scripting (XSS)** vulnerabilities across both **authenticated and unauthenticated** portions of the application. These findings present a significant security risk, as they can be leveraged to execute arbitrary JavaScript in a victim’s browser under various contexts.

## Impact and Exploitation

While XSS is often treated as a standalone issue, these vulnerabilities have broader implications. Specifically, they can be used as **launch points to exploit other significant vulnerabilities**. 

Proof of concept links follow. All testing was performed on my local docker setup running the lastest version of the application. 

## Proof of Concepts

## Authenticated Reflected XSS

```
http://localhost:8085/?ElizabethJFeinler/deletepage&incomingurl=%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3E
```

```
http://localhost:8085/?BazaR&vue=saisir&action=saisir_fiche&id=%3Cscript%3Ealert(1)%3C%2fscript%3E
```

```
http://localhost:8085/?GererThemes/upload&file=%3Cscript%3Ealert(1)%3C/script%3E
```

## Unauthenticated Reflected XSS


```
http://localhost:8085/?PagePrincipale/listpages&tags=%22%3E%3Cscript%3Ealert(1)%3C/script%3E
```

In this one, most of the parameters can be used to deliver an XSS payload, not just the template parameter. 

```
http://localhost:8085/?BazaR/bazariframe&id=2&template=<script>alert(1)</script>&width=100%25&height=600px&lat=46.22763&lon=2.213749&markersize=big&provider=MapBox&zoom=5&groups=&titles=&groupsexpanded=false
```

### Impact

The reflected XSS vulnerabilities identified pose a significant risk to both application integrity and user safety. When combined with other issues discovered such as insecure endpoints or improper authentication mechanisms. These XSS flaws can be leveraged to escalate access, hijack sessions, and in some cases, achieve remote code execution (RCE). For example, malicious JavaScript executed via XSS could be used to trigger authenticated requests that exploit backend vulnerabilities, ultimately allowing an attacker to execute arbitrary commands on the server or pivot deeper into the environment.

### Mitigation
Update to version 4.6.0