deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7947-48q7-cp5m
Package: dolibarr/dolibarr (COMPOSER)
Severity: HIGH (CVSS 7.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 18.0.4, < 18.0.7
Patched in: 18.0.7

Summary: Dolibarr Application Home Page has HTML injection vulnerability

Details:
### Summary
Observed a HTML Injection vulnerbaility in the Home page of Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS).

### Details
1. Navigate to the login page of Dolibarr application.
2. Submit a login request with the following payload in an arbitrarily supplied body parameter: "**u70ea%22%3e%3c!--HTML_Injection_By_Sai"=1**

**HTTP Post Request:**
POST /dolibarr/index.php?mainmenu=home HTTP/1.1
Host: 192.168.37.129
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://192.168.37.129/dolibarr/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 375
Origin: http://192.168.37.129
Connection: close
Cookie: <Redacted>
Upgrade-Insecure-Requests: 1

token=697c1f303ef1976a713eda01d20d8eab&actionlogin=login&loginfunction=loginfunction&backtopage=&tz=5.5&tz_string=Asia%2FKolkata&dst_observed=0&dst_first=&dst_second=&screenwidth=1280&screenheight=587&dol_hide_topmenu=&dol_hide_leftmenu=&dol_optimize_smallscreen=&dol_no_mouse_hover=&dol_use_jmobile=&username=admin&[CREDENTIAL_REDACTED]--HTML_Injection_By_Sai=1

3. Upon successful injection of the payload, some part of Home page HTML code was commented out.

**POC**
Kindly go through the below video for detailed steps:

https://user-images.githubusercontent.com/26869643/294010332-ff88d80b-cb26-4870-82d3-fb49f7ecc32f.mp4

**Remediation Suggestion**
Kindly validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks.
Implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.
GitHub Security Advisory: GHSA-vvg7-8rmq-92g7
Package: auth0/wordpress (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-863: Incorrect Authorization, CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: >= 5.0.0-BETA0, <= 5.4.0
Patched in: 5.5.0

Summary: Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency

Details:
### Description
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

### Affected product and versions
Projects are affected if they meet the following preconditions:

- Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.4.0,
- Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

### Resolution
Upgrade Auth0 Wordpress plugin to version 5.5.0 or greater.

### Acknowledgement
Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.
GitHub Security Advisory: GHSA-f3r2-88mq-9v4g
Package: auth0/symfony (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-345: Insufficient Verification of Data Authenticity, CWE-863: Incorrect Authorization, CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: >= 5.0.0, <= 5.5.0
Patched in: 5.6.0

Summary: Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK

Details:
### Description
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

### Affected product and versions
Projects are affected if they meet the following preconditions:

- Applications using the Auth0 Symfony SDK with versions between 5.0.0 and 5.5.0
- Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

### Resolution
Upgrade Auth0/symfony to version 5.6.0 or greater.

### Acknowledgement
Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.
GitHub Security Advisory: GHSA-7hh9-gp72-wh7h
Package: auth0/login (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-863: Incorrect Authorization, CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: >= 7.0.0, < 7.20.0
Patched in: 7.20.0

Summary: Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency

Details:
### Description
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

### Affected product and versions
Users are affected if they meet the following preconditions:

- Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
- Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

### Resolution
Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

### Acknowledgement
Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.
GitHub Security Advisory: GHSA-j2vm-wrq3-f7gf
Package: auth0/auth0-php (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 8.0.0, < 8.18.0
Patched in: 8.18.0

Summary: Auth0-PHP SDK has Improper Audience Validation

Details:
### Description
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.
### Affected product and versions
Projects are affected if they meet the following preconditions:

- Applications using the Auth0-PHP SDK, versions between v8.0.0 and v8.17.0, or
- Applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0:
    - a. Auth0/symfony,
    - b. Auth0/laravel-auth0,
    - c. Auth0/wordpress.

### Resolution
Upgrade Auth0/Auth0-PHP to version 8.18.0 or greater.

### Acknowledgement
Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.
GitHub Security Advisory: GHSA-mh85-44c2-3m97
Package: getgrav/grav (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.7.49.5
Patched in: unpatched

Summary: Grav is vulnerable to Stored XSS through authenticated user-edited content

Details:
grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later executed when any other user views or edits the affected page.
GitHub Security Advisory: GHSA-729w-j79f-2c34
Package: getgrav/grav (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 1.7.49.5
Patched in: unpatched

Summary: Grav may be vulnerable to SSRF attack via Twig Templates

Details:
In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration allows undefined PHP functions to be registered.
GitHub Security Advisory: GHSA-6gvq-jcmp-8959
Package: altcha-org/altcha (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-115: Misinterpretation of Input, CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 1.3.1
Patched in: 1.3.1

Summary: ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

Details:
### Impact

A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions.

The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. 

### Patches

This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation.

Users are advised to upgrade to patched versions.

### Workarounds

As a mitigation, implementations may append a delimiter to the end of the `salt` value prior to HMAC computation (for example, `<salt>?expires=<time>&`). This prevents ambiguity between parameters and the nonce and is backward-compatible with existing implementations, as the delimiter is treated as a standard URL parameter separator.
GitHub Security Advisory: GHSA-x6mh-4w8x-p34v
Package: mineadmin/mineadmin (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 3.0.9
Patched in: unpatched

Summary: MineAdmin has an insecure default password

Details:
Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover.
GitHub Security Advisory: GHSA-xmh7-35v2-fp6h
Package: yungifez/skuul (COMPOSER)
Severity: LOW (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2.6.4
Patched in: unpatched

Summary: Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images

Details:
A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user/profile of the component Image Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-947q-2xw3-gx9c
Package: fof/pretty-mail (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: <= 1.1.2
Patched in: unpatched

Summary: FoF Pretty Mail has a server-side template injection vulnerability

Details:
FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. Attackers can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.
GitHub Security Advisory: GHSA-fqq7-h225-8w6h
Package: yungifez/skuul (COMPOSER)
Severity: LOW (CVSS 3.1)
CWE: CWE-99: Improper Control of Resource Identifiers ('Resource Injection'), CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: <= 2.6.4
Patched in: unpatched

Summary: Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice

Details:
A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/fees/fee-invoices/ of the component View Fee Invoice. Performing manipulation of the argument invoice_id results in improper control of resource identifiers. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-9449-rphm-mjqr
Package: azuracast/azuracast (COMPOSER)
Severity: LOW (CVSS 3.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 0.23.1
Patched in: 0.23.2

Summary: AzuraCast Vulnerable to Pre-Auth File Deletion & Admin RCE

Details:
An API endpoint that is intended for internal use by the SFTP software `sftpgo` was mistakenly exposed to the public-facing HTTP API for AzuraCast installations.

This would allow a user with specific internal knowledge of a station's operations to craft a custom HTTP request that would affect the contents of a station's database, without revealing any internal information about the station.

With a request like:

```
curl -s -X POST "http://localhost/api/internal/sftp-event"   -H "Content-Type: application/json"   -d '{
    "action": "pre-delete",
    "username": "admin",
    "path": "/var/azuracast/stations/test/media/test.mp3"
}'
```

A remote user could simulate a request from `sftpgo` informing the software that a file was about to be deleted from the path given. In anticipation of this, AzuraCast would delete the corresponding database record for that file. While AzuraCast would then later discover on its own that the file actually exists and recreate the media record, it would not have the same playlist associations or custom metadata as the previous instance of the media record in the database.

Some mitigating factors affecting the severity of this issue include:
 - A user would need to know a valid SFTP username corresponding to the specific station in question.
 - A user would need to know the internal filesystem structure of a station (or be able to brute-force or guess paths).
 - Any call to this internal API endpoint does not return any information to the calling process about what files are present or aren't, so no confidential internal information is revealed by this process.
 
Patched versions of AzuraCast specifically check that any calls to this internal URL are being called by the internal HTTP service, which only listens for activity on `localhost` and is not accessible from outside the container.
GitHub Security Advisory: GHSA-x93p-w2ch-fg67
Package: ibexa/user (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-620: Unverified Password Change
Vulnerable versions: >= 5.0.0-beta1, < 5.0.4
Patched in: 5.0.4

Summary: Ibexa User Bundle is missing password change validation

Details:
### Impact
The vulnerability is in the password change dialog in the back office. During the transition from v4 to v5 a mistake was made in the validation code which caused the validation of the previous password to not run as expected. This made it possible for a logged in user to change password in the back office without knowing the previous password. For example if someone logs in, leaves their workstation unlocked, and another person uses the same machine.

### Credit
The issue was reported to us by Code-Rhapsodie. We thank them for their responsible disclosure!
https://www.code-rhapsodie.fr/

### Patches
- See "Patched versions".
- https://github.com/ibexa/user/commit/9d485bf385e6401c9f7ee80287d8ccd00f73dcf4

### Workarounds
None.
GitHub Security Advisory: GHSA-6w82-v552-wjw2
Package: shopware/storefront (COMPOSER)
Severity: HIGH (CVSS 7.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.7.0.0, < 6.7.5.1
Patched in: 6.7.5.1

Summary: Shopware Storefront Reflected XSS in Storefront Login Page

Details:
### Impact

By exploiting the XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. Some examples of this include, but are not limited to: Obtaining user session tokens. Performing administrative actions (when an administrative user is affected). These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.

### Description

A request parameter from the URL of the login page is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter. An attacker can create malicious links that could be used in a phishing attack. The parameter `waitTime` lacks proper input validation.

The attack can be tested with the following URL pattern:

```
/account/login?loginError=1&waitTime=<a%20href%3D"https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing">Here<%2Fa>
```

The same applies to the `errorSnippet` parameter:

```
/account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing%22%3Ehere%3C%2Fa%3E.
```
GitHub Security Advisory: GHSA-6w82-v552-wjw2
Package: shopware/shopware (COMPOSER)
Severity: HIGH (CVSS 7.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.7.0.0, < 6.7.5.1
Patched in: 6.7.5.1

Summary: Shopware Storefront Reflected XSS in Storefront Login Page

Details:
### Impact

By exploiting the XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. Some examples of this include, but are not limited to: Obtaining user session tokens. Performing administrative actions (when an administrative user is affected). These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.

### Description

A request parameter from the URL of the login page is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter. An attacker can create malicious links that could be used in a phishing attack. The parameter `waitTime` lacks proper input validation.

The attack can be tested with the following URL pattern:

```
/account/login?loginError=1&waitTime=<a%20href%3D"https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing">Here<%2Fa>
```

The same applies to the `errorSnippet` parameter:

```
/account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing%22%3Ehere%3C%2Fa%3E.
```
GitHub Security Advisory: GHSA-6w82-v552-wjw2
Package: shopware/storefront (COMPOSER)
Severity: HIGH (CVSS 7.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.4.6.0, < 6.6.10.10
Patched in: 6.6.10.10

Summary: Shopware Storefront Reflected XSS in Storefront Login Page

Details:
### Impact

By exploiting the XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. Some examples of this include, but are not limited to: Obtaining user session tokens. Performing administrative actions (when an administrative user is affected). These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.

### Description

A request parameter from the URL of the login page is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter. An attacker can create malicious links that could be used in a phishing attack. The parameter `waitTime` lacks proper input validation.

The attack can be tested with the following URL pattern:

```
/account/login?loginError=1&waitTime=<a%20href%3D"https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing">Here<%2Fa>
```

The same applies to the `errorSnippet` parameter:

```
/account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing%22%3Ehere%3C%2Fa%3E.
```
GitHub Security Advisory: GHSA-6w82-v552-wjw2
Package: shopware/shopware (COMPOSER)
Severity: HIGH (CVSS 7.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.4.6.0, < 6.6.10.10
Patched in: 6.6.10.10

Summary: Shopware Storefront Reflected XSS in Storefront Login Page

Details:
### Impact

By exploiting the XSS vulnerabilities, malicious actors can perform harmful actions in the user's web browser in the session context of the affected user. Some examples of this include, but are not limited to: Obtaining user session tokens. Performing administrative actions (when an administrative user is affected). These vulnerabilities pose a high security risk. Since a sensitive cookie is not configured with the HttpOnly attribute and administrator JWTs are stored in sessionStorage, any successful XSS attack could enable the theft of session cookies and administrative tokens.

### Description

A request parameter from the URL of the login page is directly rendered within the Twig template of the Storefront login page without further processing or input validation. This allows direct code injection into the template via the URL parameter. An attacker can create malicious links that could be used in a phishing attack. The parameter `waitTime` lacks proper input validation.

The attack can be tested with the following URL pattern:

```
/account/login?loginError=1&waitTime=<a%20href%3D"https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing">Here<%2Fa>
```

The same applies to the `errorSnippet` parameter:

```
/account/login?loginError=1&errorSnippet=Reset%20your%20password%20%3Ca%20href%3D%22https%3A%2F%2Fde.wikipedia.org%2Fwiki%2FPhishing%22%3Ehere%3C%2Fa%3E.
```
GitHub Security Advisory: GHSA-5j8p-438x-rgg5
Package: onelogin/php-saml (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: >= 4.0.0, < 4.3.1
Patched in: 4.3.1

Summary:  SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475 

Details:
**Summary**

There is a critical vulnerability on xmlseclibs [CVE-2025-66475](https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9), a dependency of php-saml

Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs:
- [2.21.1](https://github.com/SAML-Toolkits/php-saml/releases/tag/2.21.1)
- [3.8.1](https://github.com/SAML-Toolkits/php-saml/releases/tag/3.8.1)
- [4.3.1](https://github.com/SAML-Toolkits/php-saml/releases/tag/4.3.1)


**Impact**

Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.