deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-v8jw-8w5p-23g3
Package: wwbn/avideo (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 21.0
Patched in: unpatched

Summary: AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

Details:
## Summary
An authenticated Remote Code Execution (RCE) vulnerability was identified in AVideo related to the plugin upload/import functionality.

The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient validation of extracted file contents, the archive was extracted directly into a web-accessible plugin directory, allowing arbitrary PHP code execution.

## Vulnerability Type
- Remote Code Execution (RCE)
- CWE-434: Unrestricted Upload of File with Dangerous Type

## Affected Versions
- All versions up to and including 22.x.

## Fixed Version
- A fix is expected to be released in version 23.

## Root Cause
The system validated only the ZIP extension of uploaded plugin packages but did not enforce a strict allowlist of file types within the archive. Extracted files were placed directly in a web-accessible directory without preventing execution of server-side scripts.

## Impact
An authenticated administrator could execute arbitrary code on the server, resulting in full system compromise, including:
- Confidentiality loss
- Integrity loss
- Availability impact

## Remediation
Upgrade immediately to **AVideo version 23 or later**.

Version 23 introduces improved validation and secure handling of plugin extraction.

## Workarounds
If upgrade is not immediately possible:
- Disable plugin upload/import functionality.
- Configure the web server to prevent execution of PHP files inside plugin upload directories.
GitHub Security Advisory: GHSA-pv87-r9qf-x56p
Package: wwbn/avideo (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 21.0.0
Patched in: unpatched

Summary: AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

Details:
## Impact

An unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components.

The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms.

This allows an unauthenticated attacker to:

- Execute arbitrary SQL queries
- Perform full database exfiltration
- Extract sensitive data including administrator usernames, password hashes, session identifiers and user records
- Potentially escalate privileges by cracking password hashes offline
- Chain with authenticated vulnerabilities to achieve full system compromise

This vulnerability is classified as:
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)


## Patches

This vulnerability has been fixed in version 23.

Users must upgrade to version 23 or later.


## Workarounds

There is no reliable workaround.

The only recommended mitigation is to upgrade immediately to version 23 upon its release.


## References

Internal security report.
GitHub Security Advisory: GHSA-5vrj-wf7v-5wr7
Package: statamic/cms (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.0-alpha.1, < 6.4.0
Patched in: 6.4.0

Summary: Statamic vulnerable to privilege escalation via stored cross-site scripting

Details:
### Impact
Stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

### Patches
This has been fixed in 5.73.11 and 6.4.0.
GitHub Security Advisory: GHSA-5vrj-wf7v-5wr7
Package: statamic/cms (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.73.11
Patched in: 5.73.11

Summary: Statamic vulnerable to privilege escalation via stored cross-site scripting

Details:
### Impact
Stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious JavaScript that executes when viewed by higher-privileged users.

### Patches
This has been fixed in 5.73.11 and 6.4.0.
GitHub Security Advisory: GHSA-w878-f8c6-7r63
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 6.0.0-alpha.1, < 6.4.0
Patched in: 6.4.0

Summary: Statamic's missing authorization allows access to email addresses

Details:
### Impact
User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission.

### Patches
This has been fixed in 5.73.11 and 6.4.0.
GitHub Security Advisory: GHSA-w878-f8c6-7r63
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 5.73.11
Patched in: 5.73.11

Summary: Statamic's missing authorization allows access to email addresses

Details:
### Impact
User email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the “view users” permission.

### Patches
This has been fixed in 5.73.11 and 6.4.0.
GitHub Security Advisory: GHSA-cwpp-325q-2cvp
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 6.0.0-alpha.1, < 6.4.0
Patched in: 6.4.0

Summary: Statamic Vulnerable to Server-Side Request Forgery via Glide

Details:
### Impact

When Glide image manipulation is used in insecure mode (which is *not* the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server.


## Patches

This has been fixed in 5.73.11 and 6.4.0.
GitHub Security Advisory: GHSA-cwpp-325q-2cvp
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 5.73.11
Patched in: 5.73.11

Summary: Statamic Vulnerable to Server-Side Request Forgery via Glide

Details:
### Impact

When Glide image manipulation is used in insecure mode (which is *not* the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the URL directly or via the watermark feature. That can allow access to internal services, cloud metadata endpoints, and other hosts reachable from the server.


## Patches

This has been fixed in 5.73.11 and 6.4.0.
GitHub Security Advisory: GHSA-rw9x-pxqx-q789
Package: statamic/cms (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 6.0.0, < 6.4.0
Patched in: 6.4.0

Summary: Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Details:
## Impact

Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended verification step. This can allow access to sensitive operations and, depending on the user’s existing permissions, may lead to privilege escalation.

## Patches
This has been fixed in 6.4.0.
GitHub Security Advisory: GHSA-w22q-m2fm-x9f4
Package: thorsten/phpmyfaq (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 4.0.18
Patched in: 4.0.18

Summary: phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

Details:
### Summary

The WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, CAPTCHA, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled.

### Details

**File:** `phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/WebAuthnController.php`, lines 63-79

```php
#[Route(path: 'webauthn/prepare', name: 'api.private.webauthn.prepare', methods: ['POST'])]
public function prepare(Request $request): JsonResponse
{
    $data = json_decode($request->getContent(), ...);
    $username = Filter::filterVar($data->username, FILTER_SANITIZE_SPECIAL_CHARS);

    if (!$this->user->getUserByLogin($username, raiseError: false)) {
        try {
            $this->user->createUser($username);
            $this->user->setStatus(status: 'active');
            $this->user->setAuthSource(AuthenticationSourceType::AUTH_WEB_AUTHN->value);
            $this->user->setUserData([
                'display_name' => $username,
                'email' => $username,
            ]);
```

The endpoint:
1. Accepts any POST request with a JSON `username` field
2. If the username doesn't exist, creates a new **active** user account
3. Does NOT check if WebAuthn support is enabled (`security.enableWebAuthnSupport`)
4. Does NOT check if registration is enabled (`security.enableRegistration`)
5. Does NOT verify CSRF tokens
6. Does NOT require captcha validation
7. Has no rate limiting

### PoC

```bash
# Create an account - no auth needed
curl -X POST https://TARGET/api/webauthn/prepare \
  -H 'Content-Type: application/json' \
  -d '{"username":"attacker_account"}'

# Mass account creation
for i in $(seq 1 1000); do
  curl -s -X POST https://TARGET/api/webauthn/prepare \
    -H 'Content-Type: application/json' \
    -d "{\"username\":\"spam_user_$i"}" &
done
```

### Impact

- **Registration bypass:** Accounts created even when self-registration is disabled
- **Username squatting:** Reserve usernames before legitimate users
- **Database exhaustion:** Create millions of fake active accounts (DoS)
- **User enumeration:** Different responses for existing vs new usernames
- **Security control bypass:** WebAuthn config check is bypassed entirely

All phpMyFAQ installations with the WebAuthn controller routed (default) are affected, regardless of configuration settings.
GitHub Security Advisory: GHSA-rfh7-7v27-6p9r
Package: funadmin/funadmin (COMPOSER)
Severity: LOW (CVSS 2.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 7.1.0-rc4
Patched in: unpatched

Summary: funadmin: XSS through Value argument in Backend Interface component

Details:
A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html of the component Backend Interface. The manipulation of the argument Value leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-gcxp-xg77-798j
Package: funadmin/funadmin (COMPOSER)
Severity: LOW (CVSS 5.5)
CWE: CWE-20: Improper Input Validation, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 7.1.0-rc4
Patched in: unpatched

Summary: funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function

Details:
A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-5m2g-4cf6-c3rg
Package: funadmin/funadmin (COMPOSER)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: <= 7.1.0-rc4
Patched in: unpatched

Summary: funadmin has Incorrect Privilege Assignment in its Configuration Handler

Details:
A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Configuration Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-fmr2-m7gc-577w
Package: funadmin/funadmin (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Vulnerable versions: <= 7.1.0-rc4
Patched in: unpatched

Summary: funadmin has Weak Password Recovery Mechanism for Forgotten Password

Details:
A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forget_code/vercode results in weak password recovery. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-8hhx-xq9j-xwfj
Package: funadmin/funadmin (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 7.1.0-rc4
Patched in: unpatched

Summary: funadmin exposes sensitive information via getMember function

Details:
A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-r5j5-q42h-fc93
Package: mautic/core (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 7.0.0-alpha, < 7.0.1
Patched in: 7.0.1

Summary: Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting

Details:
### Summary
This advisory addresses a SQL Injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.

### Mitigation

Please update to **5.2.10**, **6.0.8**, **7.0.1** or later.

### Workarounds

None.

### References

If there are any questions or comments about this advisory:

Email Mautic at [security@mautic.org](mailto:security@mautic.org)
GitHub Security Advisory: GHSA-r5j5-q42h-fc93
Package: mautic/core (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 6.0.0-alpha, < 6.0.8
Patched in: 6.0.8

Summary: Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting

Details:
### Summary
This advisory addresses a SQL Injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.

### Mitigation

Please update to **5.2.10**, **6.0.8**, **7.0.1** or later.

### Workarounds

None.

### References

If there are any questions or comments about this advisory:

Email Mautic at [security@mautic.org](mailto:security@mautic.org)
GitHub Security Advisory: GHSA-r5j5-q42h-fc93
Package: mautic/core (COMPOSER)
Severity: HIGH (CVSS 7.6)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 2.10.0, < 5.2.10
Patched in: 5.2.10

Summary: Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting

Details:
### Summary
This advisory addresses a SQL Injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.

### Mitigation

Please update to **5.2.10**, **6.0.8**, **7.0.1** or later.

### Workarounds

None.

### References

If there are any questions or comments about this advisory:

Email Mautic at [security@mautic.org](mailto:security@mautic.org)
GitHub Security Advisory: GHSA-6j87-m5qx-9fqp
Package: craftcms/cms (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0-RC1, <= 5.8.22
Patched in: 5.8.23

Summary: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

Details:
A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `Row Heading` column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.

## Prerequisites
* An administrator account
* `allowAdminChanges` must be enabled in production, which is [against security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production).

## Steps to Reproduce
1. Navigate to **Settings** → **Fields** and create a new field with Type: **Table**
1. Add a **Column Heading** and set **Column Type** to `Row Heading`
1. In **Default Values** section, add a row with the following payload:
    ```html
    <img src=x onerror="alert('XSS')">
    ```
1. Enable `Static Rows`
1. Use the field in any object (e.g., user profile fields) → then visit any user’s profile
1. Notice the XSS execution

## Resources

https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
GitHub Security Advisory: GHSA-6j87-m5qx-9fqp
Package: craftcms/cms (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.5.0-beta.1, <= 4.16.18
Patched in: 4.16.19

Summary: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type

Details:
A stored Cross-site Scripting (XSS) vulnerability exists in the `editableTable.twig` component when using the `Row Heading` column type. The application fails to sanitize input within row headings, allowing an attacker to execute arbitrary JavaScript when another user views a page with the malicious table field.

## Prerequisites
* An administrator account
* `allowAdminChanges` must be enabled in production, which is [against security recommendations](https://craftcms.com/knowledge-base/securing-craft#set-allowAdminChanges-to-false-in-production).

## Steps to Reproduce
1. Navigate to **Settings** → **Fields** and create a new field with Type: **Table**
1. Add a **Column Heading** and set **Column Type** to `Row Heading`
1. In **Default Values** section, add a row with the following payload:
    ```html
    <img src=x onerror="alert('XSS')">
    ```
1. Enable `Static Rows`
1. Use the field in any object (e.g., user profile fields) → then visit any user’s profile
1. Notice the XSS execution

## Resources

https://github.com/craftcms/cms/commit/7b372de262b8d9d2ce859f32780c3715719b6f5a
GitHub Security Advisory: GHSA-h39h-7cvg-q7j6
Package: wwbn/avideo (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 21.0.0
Patched in: unpatched

Summary: AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

Details:
### Vulnerability Type
Authenticated Server-Side Request Forgery (SSRF)

### Affected Product/Versions
AVideo versions prior to 22 (tested on AVideo 21.x).

### Root Cause Summary
The `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints).

### Impact Summary
An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment.

### Resolution/Fix
This issue has been fixed in AVideo version 22. Users should upgrade to version 22.0 as soon as possible.

### Credits/Acknowledgement
Thanks to Arkadiusz Marta for responsibly reporting this issue.
- GitHub Profile: https://github.com/arkmarta/
GitHub Security Advisory: GHSA-ggxq-2mg9-8966
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 4.5.9
Patched in: 4.5.9

Summary: Moodle has a Remote Code Execution risk via file restore

Details:
A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.
GitHub Security Advisory: GHSA-ggxq-2mg9-8966
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 5.0.0-beta, < 5.0.5
Patched in: 5.0.5

Summary: Moodle has a Remote Code Execution risk via file restore

Details:
A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.
GitHub Security Advisory: GHSA-ggxq-2mg9-8966
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 5.1.0-beta, < 5.1.2
Patched in: 5.1.2

Summary: Moodle has a Remote Code Execution risk via file restore

Details:
A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.