deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-fg89-g389-p346
Package: bagisto/bagisto (COMPOSER)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), CWE-87: Improper Neutralization of Alternate XSS Syntax
Vulnerable versions: <= 2.3.7
Patched in: 2.3.8

Summary: bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)

Details:
### Summary
In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser.

### Details
The underlying problem is that SVG is XML/markup, so when it is uploaded and then directly rendered or embedded, script or event handlers within are allowed to run unless sanitized. In Bagisto, the integration of TinyMCE’s image upload (or media manager) may accept SVG files without sanitizing or rejecting unsafe content. When the SVG is later included (inline or via object/embed) in content displayed in admin or UI, the browser may execute the script portion of the SVG. The application might not validate the file content (i.e. inspect the SVG XML) or strip <script>, onload, onclick, foreignObject, xlink:href injection, objects/embed tags, etc.

### PoC
Navigate to any forms with TinyMCE editor. Attempt to upload a SVG file with embedded JavaScript.
<img width="1580" height="795" alt="image" src="https://github.com/user-attachments/assets/17df21a4-bfcd-4c51-a963-68f68241fd2e" />
JavaScript was triggered.
<img width="1402" height="409" alt="image" src="https://github.com/user-attachments/assets/d0e326c3-6f23-449d-8f90-1e1032818d80" />

### Impact
Malicious script is stored in SVG file and executed when the content is viewed. An attacker (with upload privilege) can target other admin users or editors who view the content, enabling session hijacking, unauthorized actions, or privilege escalation.
GitHub Security Advisory: GHSA-527q-4wqv-g9wj
Package: bagisto/bagisto (COMPOSER)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 2.3.7
Patched in: 2.3.8

Summary: bagisto has Server Side Template Injection (SSTI) in Product Description

Details:
### Summary
Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being processed by the server-side templating engine when rendering product descriptions. This allows an attacker with product creation privileges to inject arbitrary template expressions that are evaluated by the backend — potentially leading to Remote Code Execution (RCE) on the server.

### Details
In Bagisto, product descriptions are rendered through Laravel’s Blade templating engine in various front-end and admin views. The product description field is not sanitized or escaped before being passed to the view, which means user-supplied data can break out of the expected string context and execute arbitrary template code.

### PoC
Create a product and enter the payload to the description.
<img width="679" height="669" alt="image" src="https://github.com/user-attachments/assets/1e5dac3f-4043-4b31-98ed-f4346feb5477" />
Preview the page, observed that the template expressions were evaluated by the backend and displayed on the screen.
<img width="1431" height="922" alt="image" src="https://github.com/user-attachments/assets/16f29c6e-05f4-40c4-9926-0c59e0a979c2" />


### Impact
RCE potential: Attackers can execute arbitrary PHP code or system commands.
Data breach: Read sensitive environment variables (.env), API keys, or database credentials.
Defacement / persistence: Inject malicious scripts or backdoors in dynamic templates.
Privilege escalation: If attackers have limited roles (e.g., product manager), they can compromise the entire application or host.
GitHub Security Advisory: GHSA-wvpg-4wrh-5889
Package: prestashop/ps_checkout (COMPOSER)
Severity: LOW (CVSS 3.8)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: >= 5.0.0, < 5.0.5
Patched in: 5.0.5

Summary: PrestaShop Checkout Target PayPal merchant account hijacking from backoffice

Details:
### Impact
Wrong usage of the PHP `array_search()` allows bypass of validation.

### Patches
The problem has been patched in versions:
- v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
- v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
- v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
- v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
- v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build number.

### Credits
[Léo CUNÉAZ](https://github.com/inem0o) reported this issue.
GitHub Security Advisory: GHSA-wvpg-4wrh-5889
Package: prestashop/ps_checkout (COMPOSER)
Severity: LOW (CVSS 3.8)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 4.4.1
Patched in: 4.4.1

Summary: PrestaShop Checkout Target PayPal merchant account hijacking from backoffice

Details:
### Impact
Wrong usage of the PHP `array_search()` allows bypass of validation.

### Patches
The problem has been patched in versions:
- v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
- v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
- v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
- v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
- v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build number.

### Credits
[Léo CUNÉAZ](https://github.com/inem0o) reported this issue.
GitHub Security Advisory: GHSA-fpxp-pfqm-x54w
Package: prestashop/ps_checkout (COMPOSER)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 5.0.0, < 5.0.5
Patched in: 5.0.5

Summary: PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure

Details:
# Impact
Missing validation on input vulnerable to directory traversal.

# Patches
The problem has been patched in versions:

v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build number.

# Credits
[Léo CUNÉAZ](https://github.com/inem0o) for reportied this issue.
GitHub Security Advisory: GHSA-fpxp-pfqm-x54w
Package: prestashop/ps_checkout (COMPOSER)
Severity: MODERATE (CVSS 4.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 4.4.1
Patched in: 4.4.1

Summary: PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure

Details:
# Impact
Missing validation on input vulnerable to directory traversal.

# Patches
The problem has been patched in versions:

v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build number.

# Credits
[Léo CUNÉAZ](https://github.com/inem0o) for reportied this issue.
GitHub Security Advisory: GHSA-54hq-mf6h-48xh
Package: prestashop/ps_checkout (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 5.0.0, < 5.0.5
Patched in: 5.0.5

Summary: PrestaShop Checkout allows customer account takeover via email

Details:
# Impact
Missing validation on Express Checkout feature allows silent log-in

## Affected versions

The issue was introduced in PrestaShop Checkout 1.3.0 .

All versions above 1.3.0 are vulnerable except of course the patch versions published on 16/10/2025: 7.4.4.1, 8.4.4.1, 7.5.0.5, 8.5.0.5, 9.5.0.5

# Patches
The problem has been patched in versions

- v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
- v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
- v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
- v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
- v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read our [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about our build numbers and versions of PrestaShop Checkout

# Credits
We would like to thank [Léo CUNÉAZ](https://github.com/inem0o) for reporting the issue.
GitHub Security Advisory: GHSA-67px-r26w-598x
Package: bagisto/bagisto (COMPOSER)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), CWE-87: Improper Neutralization of Alternate XSS Syntax
Vulnerable versions: <= 2.3.7
Patched in: 2.3.8

Summary: bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML)

Details:
### Summary
In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser.

### Details
The application blocks the uploading of HTML files; however, if the backend detected that the content of the .png file is HTML or JavaScript, the file extension will be automatically converted from .png to .html. When the HTML is viewed, it will execute the JavaScript code.

### PoC
Created a html file, renamed the extension to .png, and uploaded the file. It was converted to HTML file in the backend. When opened in another tab, the JavaScript code will execute.
<img width="1605" height="702" alt="image" src="https://github.com/user-attachments/assets/bd9406aa-2380-464f-ac21-32d483639969" />
<img width="1358" height="314" alt="image" src="https://github.com/user-attachments/assets/e5a64a5a-39fb-4fdb-ada9-14c4b9554803" />

### Impact
A aalicious script is stored in HTML file and executed when the content is viewed. An attacker (with upload privilege) can target other admin users or editors who view the content, enabling session hijacking, unauthorized actions, or privilege escalation.
GitHub Security Advisory: GHSA-frc6-pwgr-c28w
Package: librenms/librenms (COMPOSER)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 25.10.0
Patched in: 25.10.0

Summary: LibreNMS has a Stored XSS vulnerability in its Alert Transport name field

Details:
### Summary

LibreNMS <= 25.8.0 contains a **Stored Cross-Site Scripting (XSS)** vulnerability in the Alert Transports management functionality. When an administrator creates a new Alert Transport, the value of the `Transport name` field is stored and later rendered in the **Transports** column of the **Alert Rules** page without proper input validation or output encoding. This leads to arbitrary JavaScript execution in the admin’s browser.

### Details

* **Injection point:** `Transport name` field in `/alert-transports`.
* **Execution point:** **Transports** column in `/alert-rules`.
* **Scope:** Only administrators can create Alert Transports, and only administrators can view the affected Alert Rules page. Therefore, both exploitation and impact are limited to admin users.

### Steps to reproduce

1. Log in with an administrator account.
2. Navigate to:

   ```
   http://localhost:8000/alert-transports
   ```
3. Click **Create alert transport** and provide the following values:

   * **Transport name:**

     ```html
     'onfocus='alert(1)' autofocus=
     ```
   * **Default Alert:** `ON`
   * **Email:** `test@gmail.com` (or any valid email)
   
    Save the transport.
   
4. Navigate to ```http://localhost:8000/alert-rules```. A popup `alert(1)` is triggered, confirming that the payload executes.
<img width="1829" height="396" alt="image" src="https://github.com/user-attachments/assets/932ba17d-214d-4253-80b8-62539d1cfa28" />

### Impact

Only accounts with the admin role who access the **Alert Rules** page (`http://localhost:8000/alert-rules`) are affected.
GitHub Security Advisory: GHSA-rpjr-pcmr-9ppw
Package: alt-design/alt-redirect (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: < 1.6.4
Patched in: 1.6.4

Summary: Alt Redirect: Potential Authentication Bypass by Spoofing  through query-string stripping logic flaw

Details:
The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.
GitHub Security Advisory: GHSA-86rg-8hc8-v82p
Package: librenms/librenms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 25.6.0
Patched in: 25.7.0

Summary: LibreNMS is vulnerable to Reflected-XSS in `report_this` function

Details:
### Summary
Reflected-XSS in `report_this` function in `librenms/includes/functions.php`

### Details
Recently, it was discovered that  the `report_this` function had improper filtering (`htmlentities` function was incorrectly used in a href environment), which caused the `project_issues` parameter to trigger an XSS vulnerability.

The Vulnerable Sink:
https://github.com/librenms/librenms/blob/master/includes/functions.php#L444

### PoC
GET
`project_issues=javascript:alert(document.cookie)`

### Impact
XSS vulnerabilities allow attackers to execute malicious scripts in users' browsers, enabling unauthorized access to sensitive data, session hijacking, or malware distribution.

### Suggestion
It is recommended to filter dangerous protocols, e.g. `javascript:`/`file:`.
GitHub Security Advisory: GHSA-29mf-w486-v3vc
Package: bagisto/bagisto (COMPOSER)
Severity: HIGH (CVSS 8.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.3.6
Patched in: 2.3.7

Summary: Bagisto is vulnerable to XSS through Admin Panel's product creation path

Details:
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
GitHub Security Advisory: GHSA-64mv-9655-37hx
Package: drupal-pattern-lab/unified-twig-extensions (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.1.0
Patched in: unpatched

Summary: drupal-pattern-lab/unified-twig-extensions is vulnerable to XXS

Details:
Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data.

**Note:**
This is exploitable only if the code is executed outside of Drupal; the function is intended to be shared between Drupal and Pattern Lab.

The package drupal-pattern-lab/unified-twig-extensions is unmaintained, the fix for this issue exists in version 1.1.1 of [drupal/unified_twig_ext](https://www.drupal.org/project/unified_twig_ext), but is not published to the Composer PHP registry.
GitHub Security Advisory: GHSA-6w8r-xgqq-qg6g
Package: open-web-analytics/open-web-analytics (COMPOSER)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 1.8.1
Patched in: 1.8.1

Summary: Open Web Analytics Server is vulnerable to SQL Injection

Details:
Open Web Analytics (OWA) before 1.8.1 allows SQL injection.
GitHub Security Advisory: GHSA-chw4-gjvw-3gxc
Package: melisplatform/melis-cms-slider (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-43: Path Equivalence: 'filename....' (Multiple Trailing Dot)
Vulnerable versions: < 5.3.1
Patched in: 5.3.1

Summary: Melis Platform CMS Unauthenticated File Upload Leading to RCE

Details:
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
GitHub Security Advisory: GHSA-p3vc-g9f9-mgw4
Package: melisplatform/melis-core (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 5.3.11
Patched in: 5.3.11

Summary: Melis Platform CMS Unauthenticated Admin Account Creation

Details:
Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'.
GitHub Security Advisory: GHSA-mrmx-jfw8-qhgv
Package: melisplatform/melis-cms (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 5.3.4
Patched in: 5.3.4

Summary: Melis Platform CMS SQL Injection

Details:
SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.
GitHub Security Advisory: GHSA-q769-phqg-263r
Package: webreinvent/vaahcms (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.3.1
Patched in: unpatched

Summary: VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

Details:
Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php
GitHub Security Advisory: GHSA-xgr2-5837-hf48
Package: novosga/novosga (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-521: Weak Password Requirements
Vulnerable versions: <= 2.2.12
Patched in: unpatched

Summary: NovoSGA: Manipulation of User Creation Page can lead to weak password requirements

Details:
A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-9wj2-4hcm-r74j
Package: thorsten/phpmyfaq (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-284: Improper Access Control, CWE-286: Incorrect User Management
Vulnerable versions: >= 4.0.7, < 4.0.13
Patched in: 4.0.13

Summary: phpMyFAQ duplicate email registration allows multiple accounts with the same email

Details:
### Summary
phpMyFAQ does not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover.

### Details
An account management logic flaw in phpMyFAQ allows attackers to register multiple accounts under the same email address. If email is used for password reset or administrative flows, this may result in account takeover, loss of accountability, and abuse of business logic.
### PoC

1.Register  a user with email test@example.com
2.Register another user with the same email.
3.Both accounts appear in /admin/?action=user&user_action=listallusers.
<img width="1150" height="628" alt="image" src="https://github.com/user-attachments/assets/8c19f01a-e897-4ca7-b3f8-fcf83e6ff952" />

### Impact

-Data integrity loss: Multiple accounts mapped to one email break auditability.
-Password reset ambiguity: If reset flow relies on email only, attackers can target or take over accounts.
-Privilege escalation: If one account with the same email has admin privileges, an attacker controlling the email may escalate.
-Spam / DoS: Attackers can mass-register accounts with a single email to pollute the system.

This is a business logic / authentication vulnerability. Impacted users are anyone relying on phpMyFAQ’s account system where email is assumed to be unique.
GitHub Security Advisory: GHSA-27hj-48r9-x2vx
Package: dolibarr/dolibarr (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 21.0.3
Patched in: 21.0.3

Summary: Dolibarr vulnerable to RCE via the computed field parameter

Details:
Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.
GitHub Security Advisory: GHSA-7jp2-5h22-m432
Package: auth0/symfony (COMPOSER)
Severity: LOW (CVSS 3.3)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: >= 2.0.2, <= 5.4.1
Patched in: 5.5.0

Summary: Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

Details:
### Overview
In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

### Am I affected?
You are affected by this vulnerability if you meet the following preconditions:
1. Applications using the Auth0 Symfony SDK with versions between 2.0.2 and 5.4.1,
2. Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

### Fix
Upgrade Auth0/symfony to version 5.5.0 or greater.

### Acknowledgement
Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.
GitHub Security Advisory: GHSA-w22c-pw5m-482x
Package: auth0/wordpress (COMPOSER)
Severity: LOW (CVSS 3.3)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: > 5.0.0-BETA0, <= 5.3.0
Patched in: 5.4.0

Summary: Auth0 Wordpress plugin Does Not Properly Handle File Types in Bulk User Import

Details:
### Overview
In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.


### Am I affected?
You are affected by this vulnerability if you meet the following preconditions:
1. Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.3.0,
2. Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

### Fix
Upgrade Auth0 Wordpress plugin to version 5.4.0 or greater.

### Acknowledgement
Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.