deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54725
Published: 2025-08-28
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through <= 1.7.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Theme/golo/vulnerability/wordpress-golo-theme-1-7-0-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-54731
Published: 2025-08-28
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through <= 3.5.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/youtube-showcase/vulnerability/wordpress-youtube-showcase-plugin-3-5-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54733
Published: 2025-08-28
Description: Missing Authorization vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All Bootstrap Blocks: from n/a through <= 1.3.28.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/all-bootstrap-blocks/vulnerability/wordpress-all-bootstrap-blocks-plugin-1-3-28-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54734
Published: 2025-08-28
Description: Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Slider: from n/a through <= 1.1.30.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/b-slider/vulnerability/wordpress-b-slider-plugin-1-1-30-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54738
Published: 2025-08-28
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Jobmonster: from n/a through <= 4.7.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-7-9-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-54742
Published: 2025-08-28
Description: Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 4.4.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-4-4-8-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58123
Published: 2025-08-28
Description: Improper Certificate Validation in Checkmk Exchange plugin BGP Monitoring allows attackers in MitM position to intercept traffic.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://exchange.checkmk.com/p/bgp-mon
CVE: CVE-2025-58124
Published: 2025-08-28
Description: Improper Certificate Validation in Checkmk Exchange plugin check-mk-api allows attackers in MitM position to intercept traffic.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://exchange.checkmk.com/p/check-mk-api
CVE: CVE-2025-58125
Published: 2025-08-28
Description: Improper Certificate Validation in Checkmk Exchange plugin Freebox v6 agent allows attackers in MitM position to intercept traffic.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://exchange.checkmk.com/p/freebox-v6
CVE: CVE-2025-58126
Published: 2025-08-28
Description: Improper Certificate Validation in Checkmk Exchange plugin VMware vSAN allows attackers in MitM position to intercept traffic.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://exchange.checkmk.com/p/vsan
CVE: CVE-2025-58127
Published: 2025-08-28
Description: Improper Certificate Validation in Checkmk Exchange plugin Dell Powerscale allows attackers in MitM position to intercept traffic.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295
References: https://exchange.checkmk.com/p/powerscale
CVE: CVE-2024-49790
Published: 2025-08-28
Description: IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7243389
CVE: CVE-2025-51967
Published: 2025-08-28
Description: A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails to sanitize user-supplied input in the theme POST parameter, allowing an attacker to inject and execute arbitrary JavaScript in a victim's browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jairajparyani/CVE-s/blob/main/CVE-2025-51967%20%E2%80%93%20Reflected%20XSS%20in%20School%20Management%20System
CVE: CVE-2025-51968
Published: 2025-08-28
Description: A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The application fails to properly sanitize user-supplied input in the proId POST parameter, allowing attackers to inject arbitrary SQL expressions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/jairajparyani/CVE-s/blob/main/CVE-2025-51968%20%E2%80%93%20SQL%20Injection%20in%20Online%20Shopping%20System%20Advanced
CVE: CVE-2025-51969
Published: 2025-08-28
Description: A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0. This flaw is present in the product_id GET parameter, which is not properly validated before being included in a SQL statement.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/jairajparyani/CVE-s/blob/main/CVE-2025-51969%20%E2%80%93%20SQL%20Injection%20in%20Online%20Shopping%20System%20Advanced
CVE: CVE-2025-51971
Published: 2025-08-28
Description: A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Advanced 1.0. Unsanitized user input in the f_name parameter is reflected in the server response without proper HTML encoding or output escaping. This allows remote attackers to inject arbitrary JavaScript code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://github.com/jairajparyani/CVE-s/blob/main/CVE-2025-51971%20%E2%80%93%20Reflected%20Cross-Site%20Scripting%20%28XSS%29%20in%20Online%20Shopping%20System
CVE: CVE-2025-51972
Published: 2025-08-28
Description: A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/jairajparyani/CVE-s/blob/main/CVE-2025-51972%20%E2%80%93%20SQL%20Injection%20in%20Online%20Shopping%20System
CVE: CVE-2025-9578
Published: 2025-08-28
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40734.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://security-advisory.acronis.com/advisories/SEC-9107
CVE: CVE-2024-48908
Published: 2025-08-28
Description: lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.
CWE: CWE-94
References: https://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d455af97419279d86aafaede; https://github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x
CVE: CVE-2025-52054
Published: 2025-08-28
Description: An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The root password of the device is calculated with a static string and the last two octets of the MAC address of the device. This allows an unauthenticated attacker to authenticate with network services on the device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://www.virtualhackinglabs.com/advisories/cve-2025-52054-tenda-ac8-calculated-root-password/
CVE: CVE-2025-54995
Published: 2025-08-28
Description: Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-1286
References: https://github.com/asterisk/asterisk/commit/0278f5bde14565c6838a6ec39bc21aee0cde56a9; https://github.com/asterisk/asterisk/commit/eafcd7a451dcd007dddf324ac37dd55a4808338d; https://github.com/asterisk/asterisk/pull/1405
CVE: CVE-2025-55583
Published: 2025-08-28
Description: D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-306, CWE-668
References: https://cybermaya.in/posts/Post-44/; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10397; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-56236
Published: 2025-08-28
Description: FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/FormCms/FormCms/issues/27; https://github.com/KKC73/me/blob/main/CVE-2025-56236/README.md
CVE: CVE-2025-8067
Published: 2025-08-28
Description: A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this handle, it receives the file descriptor list and index specifying the file where the loop device should be backed. The function itself validates the index value to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound, allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by privileged users.
CVSS Score: 8.5 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2025:15017; https://access.redhat.com/errata/RHSA-2025:15018; https://access.redhat.com/errata/RHSA-2025:15020
CVE: CVE-2024-13986
Published: 2025-08-28
Description: Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation results in the placement of attacker-controlled PHP files in a web-accessible directory, executed as the www-data user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434, CWE-22, CWE-434
References: https://theyhack.me/Nagios-XI-Authenticated-RCE; https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi
CVE: CVE-2025-25010
Published: 2025-08-28
Description: Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://discuss.elastic.co/t/kibana-9-0-6-9-1-3-security-update-esa-2025-13/381426
CVE: CVE-2025-29364
Published: 2025-08-28
Description: spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system calls. The application verifies the legitimacy of the starting and ending addresses for memory read/write operations. By configuring the starting and ending addresses for memory read/write to point to distinct memory segments within the virtual machine, it is possible to circumvent these checks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://gist.github.com/Giles-one/a398e3da21ea9567970c6f0de543c3b3; https://github.com/Giles-one/spimsimulatorEscape?tab=readme-ov-file#bug2-bypass-check-in-read_syscall-and-write_syscall-leading-to-out-of-bounds-readwrite
CVE: CVE-2025-51643
Published: 2025-08-28
Description: Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper protection. An attacker with physical access to the device can use a standard SPI programmer to extract the firmware using flashrom. This results in exposure of sensitive configuration data such as APN credentials, backend server information, and network parameter
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://github.com/NastyCrow/CVE-2025-51643
CVE: CVE-2025-57767
Published: 2025-08-28
Description: Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header with an incorrect realm was received without a previous 401 response being sent, the get_authorization_header() function in res_pjsip_authenticator_digest will return a NULL. This wasn't being checked before attempting to get the digest algorithm from the header which causes a SEGV. This issue has been patched in versions 20.15.2, 21.10.2, and 22.5.2. There are no workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-253
References: https://github.com/asterisk/asterisk/commit/02993717b08f899d4aca9888062f35dfb198584f; https://github.com/asterisk/asterisk/pull/1407; https://github.com/asterisk/asterisk/security/advisories/GHSA-64qc-9x89-rx5j
CVE: CVE-2025-31972
Published: 2025-08-28
Description: HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123631
CVE: CVE-2025-31977
Published: 2025-08-28
Description: HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms.  An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123631
CVE: CVE-2025-31979
Published: 2025-08-28
Description: A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or web shells, by bypassing client-side or server-side validation mechanisms.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123631
CVE: CVE-2025-57756
Published: 2025-08-28
Description: Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. A workaround involves disabling the front end search.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-612
References: https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index; https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514; https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
CVE: CVE-2025-57757
Published: 2025-08-28
Description: Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protected news archives to the news feed page.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-212
References: https://contao.org/en/security-advisories/information-disclosure-in-the-news-module; https://github.com/contao/contao/commit/e75f46b11974fbf7a4652e65c19ad6ca84c59271; https://github.com/contao/contao/security/advisories/GHSA-w53m-gxvg-vx7p
CVE: CVE-2025-57758
Published: 2025-08-28
Description: Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://contao.org/en/security-advisories/improper-access-control-in-the-back-end-voters; https://github.com/contao/contao/commit/3f05c603e1c94d34819f837f060df5d66447d0d7; https://github.com/contao/contao/security/advisories/GHSA-7m47-r75r-cx8v
CVE: CVE-2025-57759
Published: 2025-08-28
Description: Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://contao.org/en/security-advisories/improper-privilege-management-for-page-and-article-fields; https://github.com/contao/contao/commit/80ee7db12d55ad979d9b1b180f273d4e2668851f; https://github.com/contao/contao/security/advisories/GHSA-qqfq-7cpp-hcqj
CVE: CVE-2025-57819
Published: 2025-08-28
Description: FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-288
References: https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203; https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h; https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819
CVE: CVE-2025-58334
Published: 2025-08-28
Description: In JetBrains IDE Services before 2025.5.0.1086, 
2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-58335
Published: 2025-08-28
Description: In JetBrains Junie before 252.284.66,
251.284.66,
243.284.66,
252.284.61,
251.284.61,
243.284.61,
252.284.50,
252.284.54,
251.284.54,
251.284.50,
243.284.54,
243.284.50 information disclosure was possible via search_project function
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-356
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-31971
Published: 2025-08-28
Description: AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability.  The issue may allow attackers to launch a server-side request forgery (SSRF) attack enabling unauthorized network calls from the system, potentially exposing internal services or sensitive information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-425
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123600
CVE: CVE-2025-57217
Published: 2025-08-28
Description: Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7WebsSecurityHandler.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-121
References: https://plaid-knot-11b.notion.site/Stack-Buffer-Overflow-in-login-Auth-via-Password-parameter-Remote-attacker-can-execute-arbitrary-c-23fb3e9cce32800ba969f8b3a9f80bda?source=copy_link
CVE: CVE-2025-57218
Published: 2025-08-28
Description: Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function sub_46284C.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-121
References: https://plaid-knot-11b.notion.site/Stack-Buffer-Overflow-in-goform-WifiBasicSet-via-Password-parameter-Remote-attacker-can-execute-ar-23fb3e9cce32807c883fc1b233e09eca?source=copy_link
CVE: CVE-2025-58047
Published: 2025-08-28
Description: Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. The problem has been patched in versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-alpha.4. To mitigate downtime, have setup automatically restart processes that quit with an error.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://github.com/plone/volto/commit/2789a287ac45ad9039fb9161d465ba13241fff0a; https://github.com/plone/volto/releases/tag/16.34.0; https://github.com/plone/volto/releases/tag/17.22.1
CVE: CVE-2025-58048
Published: 2025-08-28
Description: Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context. This vulnerability was patched by commit 87c3db4 and was released under the version 1.2.11 tag without any other code modifications compared to version 1.2.10. If upgrading is not immediately possible, administrators can mitigate this vulnerability with one or more of the following measures: updating nginx config to download attachments instead of executing them or disallowing access to /storage/ fully using a WAF such as Cloudflare.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://github.com/Paymenter/Paymenter/commit/87c3db42282ada1e3cda54b9a01f846926c0669b; https://github.com/Paymenter/Paymenter/releases/tag/v1.2.11; https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj