deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-ggw7-9675-6v4v
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: >= 2.26.1, <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT has an authorization bypass in private issue monitoring

Details:
Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private issue.


### Impact
Direct access to the private issue remains blocked, but the user will receive email notifications for updates, leading to disclosure of the private issue's metadata and content.

### Patches
- 0a93267deba445fb9d15250c16e6fdb1246ffa65

### Workarounds
None

### Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.
GitHub Security Advisory: GHSA-fvjf-68wh-rwp2
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form

Details:
When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepends the source Project name before the category selector without proper escaping, allowing an attacker able to to inject HTML if they can set the Project's name (which typically requires *manager* or *administrator* access level).


### Impact
Cross-site scripting (XSS).
This is mitigated by Content Security Policy which restricts scripts execution.

### Patches
- df22697ae497ddd93f3d9132fdf4979db8d081cd

### Workarounds
Make sure Project names do not contain any HTML tags.

### Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.

The vulnerability was also identified and independently reported by @siunam321 (Tang Cheuk Hei), prior to this Advisory's publication.
GitHub Security Advisory: GHSA-frf7-jhp9-jxm6
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 2.28.1
Patched in: 2.28.2

Summary: MantisBT Vulnerable to Privilege Escalation from Manager to Administrator

Details:
Insufficient access control checks in _ProjectUsersAddCommand_ (used in *manage_proj_user_add.php* and REST API endpoint `PUT /project/{id}/users`) allows users having *manage_project_threshold* access level (*manager* by default) to grant project-level *administrator* access to any user (including themselves) in any Project they have *manager* rights in.

The normal project-user add form does restrict the selectable access levels to the actor's own project role or below. However, the backend handler still accepts a forged higher access_level value and writes it.

### Impact
Privilege escalation.

The consequences of the privilege escalation are not as bad as it may sound, because having *administrator* access at Project level is effectively not very different from being *manager*, it does not actually give administrator privileges on the whole MantisBT instance. In particular, it does not let the upgraded user delete the Project or grant them any access to global administrative functions such as managing Users, Projects, Plugins, Custom Fields, etc. 

### Patches
- 69e0180f180ed5acf48a8d281a73683a7bf32461

### Workarounds
None

### Credits
Thanks to the following security researchers for independently discovering and responsibly reporting the issue:
- [Dracosec Research Limited](https://dracosec.tech/) (Siu Nam Tang, Chris Chan, Krecendo Hui, William Lam)
- Vishal Shukla
GitHub Security Advisory: GHSA-68w5-w573-q2r8
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 2.28.0, < 2.28.2
Patched in: 2.28.2

Summary: MantisBT Has Authorization Bypass in Global Profile Creation

Details:
MantisBT allows a low-privileged authenticated user having *add_profile_threshold* to create a global profile despite not having *manage_global_profile_threshold*, by tampering with the user_id parameter in a valid profile creation request.

### Impact
Authentication bypass

### Patches
- 3f952e68fa864e0e60abc3e84adecf3cfa84c75e

### Workarounds
None

### Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issues.
GitHub Security Advisory: GHSA-h29g-c9cx-c73q
Package: torrentpier/torrentpier (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 2.4.3
Patched in: 2.4.4

Summary: torrentpier has PHP Serialize Injections

Details:
### Summary
Hi, there. We've found PHP Serialize Injections in your project “torrentpier". According to the OWASP, it can pose a significant risk: enable an attacker to modify serialized objects in order to inject malicious data into the application code, resulting in code execution or an arbitrary reading of the file on any vulnerable system. 
                                        
### Details
In the attachment you can find a report with the number of vulnerabilities, their types and the vulnerable files. To view the lines of vulnerable code you may scan your project with the "[PHP Secure](https://phpsecure.net/?utm_source=github&utm_term=torrentpier&utm_content=torrentpier)" vulnerability scanner with a full access to it.

### PoC
<img width="663" alt="Screenshot 2023-09-25 at 11 12 32 AM" src="https://user-images.githubusercontent.com/118765013/270273991-4a2c3884-3ab0-48ad-af77-3f3dbfa64e2a.png">
<img width="661" alt="Screenshot 2023-09-25 at 11 12 43 AM" src="https://user-images.githubusercontent.com/118765013/270274006-247ed9d3-2dc0-4a87-8f1f-89079c8be165.png">
<img width="664" alt="Screenshot 2023-09-25 at 11 12 53 AM" src="https://user-images.githubusercontent.com/118765013/270274018-b99d6ec2-4c5a-439f-b089-9e11345e963d.png">
<img width="662" alt="Screenshot 2023-09-25 at 11 13 13 AM" src="https://user-images.githubusercontent.com/118765013/270274023-36ecffc7-215d-41db-b3ba-6aa677e644d3.png">

### About Us
We are a team of developers of the PHP Secure vulnerability scanner. First, we checked your code automatically. Then we reviewed the vulnerable code more deeply manually and felt it was necessary to report about it to you. We suggest you scanning your code and address vulnerabilities as soon as possible to prevent a potential breach.

If you have any questions, email us at support@phpsecure.net"
GitHub Security Advisory: GHSA-rvwr-q5hj-wq7g
Package: dolibarr/dolibarr (COMPOSER)
Severity: LOW (CVSS 5.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 23.0.2
Patched in: unpatched

Summary: Dolibarr has an Injection issue

Details:
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class.php of the component Shipments API Endpoint. The manipulation of the argument fields leads to sql injection. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-c3gj-q88f-7hqj
Package: studio-42/elfinder (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 2.1.67
Patched in: 2.1.68

Summary: elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)

Details:
## Summary

An authenticated SQL injection vulnerability in the elFinder MySQL volume driver (`elFinderVolumeMySQL`) allows any logged-in user, including users with read-only access to the affected volume, to inject SQL through a crafted `target` file hash. Successful exploitation can lead to unauthorized data disclosure and denial of service.

This vulnerability only affects installations configured to use the `MySQL` volume driver. Installations using the default `LocalFileSystem` driver are not affected.

## Description

A vulnerability in elFinder's MySQL volume driver (`elFinderVolumeMySQL`) allows authenticated SQL injection through a crafted file hash passed via the `target` parameter.

The issue is caused by two behaviors working together:
1. File hashes are decoded without validating that the decoded value is a valid MySQL object identifier.
2. The decoded value is then used in MySQL driver queries, including `cacheDir()`, `_joinPath()`, `_stat()`, and `_fopen()`.

Because the MySQL storage schema uses numeric `id` and `parent_id` values, an authenticated user can supply a crafted hash that alters the intended SQL query logic. Successful exploitation can lead to unauthorized data disclosure and denial of service. The extent of impact depends on the privileges granted to the configured MySQL account.

This vulnerability only affects installations configured to use the `MySQL` volume driver. Installations using the default `LocalFileSystem` driver are not affected.

## Impact

An authenticated user, including a user with read-only access to the affected volume, can exploit this issue to:
- disclose data accessible to the configured MySQL account, including file contents stored by the driver and database metadata
- trigger denial of service through expensive or unexpectedly broad query results that can lead to excessive memory consumption

The severity of data exposure depends on the privileges granted to the configured MySQL account.
GitHub Security Advisory: GHSA-mghp-5cq4-v6mg
Package: snipe/snipe-it (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 8.4.1
Patched in: 8.4.1

Summary: Snipe-IT has an open redirect vulnerability

Details:
Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable.

### Impact

-   **Phishing**: Redirect users to fake login pages to steal credentials
-   **Session Hijacking**: Redirect to attacker site that captures session cookies via JavaScript
-   **Malware Distribution**: Redirect to sites hosting malware or drive-by downloads
-   **Reputation Damage**: Users lose trust when redirected to malicious sites from legitimate application
-   **Social Engineering**: Use trusted Snipe-IT domain to increase phishing success rate

When the user clicks "Save", the application: 
1. Processes the form 
2. Checks `redirect_option` (if set to 'back') 
3. Calls `Helper::getRedirectOption()` 
4. Retrieves `back_url` from session: `https://evil.com/phishing?target=snipeit` 
5. Executes `redirect()->to($backUrl)` 
6. User is redirected to attacker's site

This would still require session poisoning, so the actual practical threat here is minimal. 

### Patches
Patched in https://github.com/grokability/snipe-it/commit/e[PII_REDACTED]1a337e68a624e589c3540b7a82373, released in 8.4.1.

### Workarounds
 None.

### Resources
-   CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
-   OWASP: Unvalidated Redirects and Forwards
-   Laravel Security: Safe Redirects

[snipeit_open_redirect_submission.md](https://github.com/user-attachments/files/27414869/snipeit_open_redirect_submission.md)
GitHub Security Advisory: GHSA-2f25-pfq3-c7h8
Package: phpseclib/phpseclib (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-834: Excessive Iteration
Vulnerable versions: >= 3.0.0, < 3.0.34
Patched in: 3.0.34

Summary: Phpseclib needs guardrails on large binaryfield integers

Details:
### Impact
Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc)

### Patches
https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f

### Workarounds
No.

### References
https://github.com/phpseclib/phpseclib/commit/964d78101a70305df33f442f5490f0adb3b7e77f
https://www.usenix.org/system/files/usenixsecurity25-shi-bing.pdf
GitHub Security Advisory: GHSA-xg82-2hrv-hf64
Package: snipe/snipe-it (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 8.4.1
Patched in: 8.4.1

Summary: Snipe-IT has insecure permissions in file uploads

Details:
Insecure Permissions vulnerability in grokability snipe-it versions through 8.4.0, fixed after 2026-03-10 commit 676a9958, allow a remote attacker to execute arbitrary code via the `app/Http/Controllers/Api/UploadedFilesController.php` component

### Impact
Users who can view assets, consumables, etc were able to send a POST request to `/api/v1/{object_type}/{id}/files`. The API authorized with "view" instead of write permission and persists the file and audit log entry.

### Patches
Fixed after 2026-03-10 commit 676a9958, fix released to 8.4.1.

### Workarounds
None.
GitHub Security Advisory: GHSA-hq28-crg7-95pr
Package: snipe/snipe-it (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-281: Improper Preservation of Permissions, CWE-863: Incorrect Authorization
Vulnerable versions: < 8.4.1
Patched in: 8.4.1

Summary: Snipe-IT has Privilege Escalation via API Permissions Assignment

Details:
### Impact
An authenticated user with only `users.edit` permission can escalate their own privileges to `admin` by sending a PATCH request to `/api/v1/users/{id}` with `permissions[admin]=1`. The API controller only strips the `superuser` key from the permissions array, allowing `admin` and all other permission keys to be set by any user who can update users.

### Patches
Patched in https://github.com/grokability/snipe-it/commit/ce18ff669ceb0f0349749fd5d11c1d3d40b10569, fix was released in v8.4.1

### Workarounds
None.
GitHub Security Advisory: GHSA-r42m-953q-6vjx
Package: snipe/snipe-it (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 8.4.1
Patched in: 8.4.1

Summary: Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)

Details:
### Impact
Users with component view access could be impacted by an unescaped `notes` column. 

### Patches
This was patched in https://github.com/grokability/snipe-it/commit/28f493d84d057895fbb93b6570e7393a2c2fa438, and is fixed in v8.4.1 or greater. 

### Workarounds
None.
GitHub Security Advisory: GHSA-h5fh-7hwr-97mw
Package: kimai/kimai (COMPOSER)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.32.0, <= 2.55
Patched in: 2.56

Summary: Kimai has an arbitrary file read in its invoice PDF renderer (admin)

Details:
## Summary

Users with the role `System-Admin` (`ROLE_SYSTE_ADMIN`) and the permission `upload_invoice_template` can upload PDF invoice templates, which can call `pdfContext.setOption('associated_files', ...)` inside the sandboxed Twig render. 

This is forwarded to mPDF's `SetAssociatedFiles()`, whose writer calls `file_get_contents($entry['path'])` during PDF output and embeds the bytes as a FlateDecode stream in the PDF. Any file readable by the PHP worker is returned to the attacker inside the rendered invoice.

## Root cause

1. `src/Twig/SecurityPolicy/StrictPolicy.php:123-128` explicitly whitelists `PdfContext::setOption()`:
   ```php
   if ($obj instanceof PdfContext) {
       if ($lcm !== 'setoption') { throw ...; }
       return;
   }
   ```

2. `src/Pdf/MPdfConverter.php` keeps `associated_files` in the pass-through allowlist:
   ```php
   $allowed = ['mode','format','default_font_size','default_font', ... , 'associated_files','additional_xmp_rdf'];
   ```
   and then forwards it to mPDF:
   ```php
   if (array_key_exists('associated_files', $options) && is_array($options['associated_files'])) {
       $associatedFiles = $options['associated_files'];
       unset($options['associated_files']);
   }
   ...
   $mpdf->SetAssociatedFiles($associatedFiles);
   ```

3. mPDF 8.3.1 `MetadataWriter::writeAssociatedFiles()` calls `file_get_contents`, which respects PHP stream wrappers:
   ```php
   if (isset($file['path'])) {
       $fileContent = @file_get_contents($file['path']);
   }
   ...
   $filestream = gzcompress($fileContent);
   $this->writer->write('<</Type /EmbeddedFile');
   ```

The sandbox and the option allowlist were both written defensively (short whitelists, not blacklists), but neither side considered that `associated_files` is a PDF/A file-embedding feature whose `path` key is a sink.

## Fix

The implemented fix has two aspects:

1. The `PdfContext` now works with a strict allow-list, that excludes `associated_files`
2. The `MPdfConverter` now removes any `path` from the `$associatedFiles` array, which can still be used by plugins:
```php
        if (\count($associatedFiles) > 0) {
            // remove "path" so mPDF will not use file_get_contents() on local files
            // callers must pre-read and pass the bytes via "content"
            $associatedFiles = array_map(static function ($entry): array {
                if (!\is_array($entry)) {
                    return [];
                }

                if (\array_key_exists('path', $entry)) {
                    unset($entry['path']);
                }

                return $entry;
            }, $associatedFiles);
            $mpdf->SetAssociatedFiles($associatedFiles);
        }

```
GitHub Security Advisory: GHSA-fmg2-f5r9-24qc
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.7.49.5
Patched in: 1.7.49.5

Summary: Grav: Stored XSS via page title (data[header][title]) in admin panel

Details:
### Summary
_A Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][title] parameter._

--- 

### Details
Vulnerable Endpoint: GET /admin/pages/[page]
Parameter: data[header][title]

The application fails to properly validate and sanitize user input in the data[header][title] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session.

--- 

### PoC
**Payload:** `<img src=1 onerror=alert(1)>`

1. Log in to the Grav Admin Panel and navigate to Pages.
 
2. Create a new page or edit an existing one.

3. Edit title of the page to  `<img src=1 onerror=alert(1)>`

<img width="1897" height="700" alt="image" src="https://github.com/user-attachments/assets/77a129ca-5c2b-4743-8c56-c17fa456eefa" />

4. Save page
 
5. Open the move function and click on the folder having the payload

<img width="1904" height="984" alt="image" src="https://github.com/user-attachments/assets/44f8f88f-76c4-449f-8c4e-11e8e2c51d8f" />

<img width="1902" height="995" alt="image" src="https://github.com/user-attachments/assets/1dc2ef15-e534-4e87-93ea-92bc573af7f1" />

--- 

### Impact

Stored cross-site scripting (XSS) attacks can have serious consequences, including:

- User actions: Attackers can perform actions on behalf of the user

- Data theft: Sensitive information such as session cookies can be stolen

- Account compromise: Attackers may impersonate legitimate users

- Malicious code execution: Arbitrary JavaScript code can run in the user’s browser

- Website defacement or misinformation: Malicious output may be injected visually

- User redirection: Victims may be redirected to phishing or malicious websites

By [Vu Duc Hieu](https://github.com/vdh1612) 
Contributor [Simon Tran](https://github.com/simontranduy)
GitHub Security Advisory: GHSA-rm34-fg4m-39mw
Package: devcode-it/openstamanager (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 2.10-beta
Patched in: unpatched

Summary: OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality 

Details:
OpenSTAManager versions 2.10 and earlier contain an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php).
GitHub Security Advisory: GHSA-f2qx-66wf-wvvx
Package: phpseclib/phpseclib (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 0.1.1, <= 1.0.22
Patched in: 1.0.23

Summary: phpseclib guardrails needed on OID length

Details:
### Impact
Any application using that loads untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc).

### Patches
https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59

### Workarounds
No.

### Resources
https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59
https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-599-shi-bing.pdf
GitHub Security Advisory: GHSA-f2qx-66wf-wvvx
Package: phpseclib/phpseclib (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.0.0, <= 3.0.35
Patched in: 3.0.36

Summary: phpseclib guardrails needed on OID length

Details:
### Impact
Any application using that loads untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc).

### Patches
https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59

### Workarounds
No.

### Resources
https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59
https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-599-shi-bing.pdf
GitHub Security Advisory: GHSA-f2qx-66wf-wvvx
Package: phpseclib/phpseclib (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.0.0, <= 2.0.46
Patched in: 2.0.47

Summary: phpseclib guardrails needed on OID length

Details:
### Impact
Any application using that loads untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc).

### Patches
https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59

### Workarounds
No.

### Resources
https://github.com/phpseclib/phpseclib/commit/e32531001b4d62c66c3d824ccef54ffad835eb59
https://www.usenix.org/system/files/conference/usenixsecurity25/sec25cycle1-prepub-599-shi-bing.pdf
GitHub Security Advisory: GHSA-3qpq-r242-jqj7
Package: phpseclib/phpseclib (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 0.1.1, <= 1.0.28
Patched in: 1.0.29

Summary: phpseclib has a CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()

Details:
### Impact
Anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc)

### Patches
https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc

### Workarounds
No.

### References
https://github.com/phpseclib/phpseclib/commit/d53d2021bcb9f6a04d5d44ec99e6bbef219a71bc