deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-m895-2hj3-8cg9
Package: shopware/core (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 6.7.0.0, < 6.7.3.1
Patched in: 6.7.3.1

Summary: Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

Details:
In Shopware core and platform versions before 6.6.10.7 and 6.7.3.1, media visibility restrictions applied by MediaVisibilityRestrictionSubscriber are not enforced for aggregation API requests. Authorization filters are only injected during standard entity reads; aggregation queries can be constructed to bypass these checks and enumerate private media records such as invoices or other restricted documents. A low‑privilege backend user (e.g., product editor) can chain normal business flows (creating or viewing orders) with aggregation queries to disclose sensitive customer data including addresses and payment-related information contained within associated private media. The issue is resolved in 6.6.10.7 and 6.7.3.1.
GitHub Security Advisory: GHSA-m895-2hj3-8cg9
Package: shopware/platform (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 6.6.10.7
Patched in: 6.6.10.7

Summary: Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

Details:
In Shopware core and platform versions before 6.6.10.7 and 6.7.3.1, media visibility restrictions applied by MediaVisibilityRestrictionSubscriber are not enforced for aggregation API requests. Authorization filters are only injected during standard entity reads; aggregation queries can be constructed to bypass these checks and enumerate private media records such as invoices or other restricted documents. A low‑privilege backend user (e.g., product editor) can chain normal business flows (creating or viewing orders) with aggregation queries to disclose sensitive customer data including addresses and payment-related information contained within associated private media. The issue is resolved in 6.6.10.7 and 6.7.3.1.
GitHub Security Advisory: GHSA-m895-2hj3-8cg9
Package: shopware/platform (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 6.7.0.0, < 6.7.3.1
Patched in: 6.7.3.1

Summary: Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

Details:
In Shopware core and platform versions before 6.6.10.7 and 6.7.3.1, media visibility restrictions applied by MediaVisibilityRestrictionSubscriber are not enforced for aggregation API requests. Authorization filters are only injected during standard entity reads; aggregation queries can be constructed to bypass these checks and enumerate private media records such as invoices or other restricted documents. A low‑privilege backend user (e.g., product editor) can chain normal business flows (creating or viewing orders) with aggregation queries to disclose sensitive customer data including addresses and payment-related information contained within associated private media. The issue is resolved in 6.6.10.7 and 6.7.3.1.
GitHub Security Advisory: GHSA-r355-75hw-r8jf
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento allows incorrect authorization

Details:
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-r355-75hw-r8jf
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento allows incorrect authorization

Details:
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-r355-75hw-r8jf
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento allows incorrect authorization

Details:
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-r355-75hw-r8jf
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: = 2.4.8
Patched in: unpatched

Summary: Magento allows incorrect authorization

Details:
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-r355-75hw-r8jf
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2.4.6-p13
Patched in: 2.4.6-p13

Summary: Magento allows incorrect authorization

Details:
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-r355-75hw-r8jf
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p8
Patched in: 2.4.7-p8

Summary: Magento allows incorrect authorization

Details:
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-r355-75hw-r8jf
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.4.8-beta1, < 2.4.8-p3
Patched in: 2.4.8-p3

Summary: Magento allows incorrect authorization

Details:
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-r355-75hw-r8jf
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.4.9-alpha1, < 2.4.9-alpha3
Patched in: 2.4.9-alpha3

Summary: Magento allows incorrect authorization

Details:
Magento versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4vrf-42cm-7xfw
Package: tastyigniter/tastyigniter (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 3.7.7
Patched in: unpatched

Summary: TastyIgniter vulnerable to Cross-Site Scripting

Details:
Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to perform unauthorized actions such as modifying the admin account credentials.
GitHub Security Advisory: GHSA-gr6v-3pmp-996p
Package: mediawiki/cargo (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.8.3
Patched in: 3.8.3

Summary: Cargo Mediawiki Extension vulnerable to Cross-site Scripting

Details:
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension befor 3.8.3.
GitHub Security Advisory: GHSA-g955-vw6w-v6pp
Package: starcitizentools/citizen-skin (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.3.0, < 3.9.0
Patched in: 3.9.0

Summary: Citizen vulnerable to stored XSS in sticky header button messages

Details:
### Summary
The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages.

### Details
In the `copyButtonAttributes` function in `stickyHeader.js`, when copying the button labels, the `innerHTML` of the new element is set to the `textContent` of the old element:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/f4cbcecf5aca0ae69966b23d4983f9cb5033f319/resources/skins.citizen.scripts/stickyHeader.js#L29-L41
This unescapes any escaped HTML characters and causes the contents of the system messages to be interpreted as HTML.

### PoC
1. Edit any of the affected messages (`citizen-share`, `citizen-view-history`, `citizen-view-edit`, `nstab-talk`) to the following payload: `<img src="" onerror="alert('Sticky Header Button XSS')">`.
2. Visit any mainpage article in the wiki using the Citizen skin.

<img width="495" height="228" alt="image" src="https://github.com/user-attachments/assets/ac75b8e1-b181-4335-9526-17d6b6f8518e" />
<img width="569" height="157" alt="image" src="https://github.com/user-attachments/assets/c052edb9-ff68-4869-9c66-3ec85e7ff68a" />


### Impact
This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. By default, this is the case for the `sysop` group.
GitHub Security Advisory: GHSA-8c2g-f8jm-5cr7
Package: ibexa/fieldtype-richtext (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.6.0, < 4.6.25
Patched in: 4.6.25

Summary: ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text

Details:
### Impact
This security advisory resolves an XSS vulnerability in acronym custom tag in Rich Text, in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and may in some cases be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
See "Patched versions".

### Workarounds
None.

### References
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office
GitHub Security Advisory: GHSA-8c2g-f8jm-5cr7
Package: ibexa/fieldtype-richtext (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0, < 5.0.3
Patched in: 5.0.3

Summary: ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text

Details:
### Impact
This security advisory resolves an XSS vulnerability in acronym custom tag in Rich Text, in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and may in some cases be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
See "Patched versions".

### Workarounds
None.

### References
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office
GitHub Security Advisory: GHSA-2mx6-fq24-g2mh
Package: ibexa/admin-ui (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.6.0, < 4.6.25
Patched in: 4.6.25

Summary: ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

Details:
### Impact
This security advisory resolves an XSS vulnerability in image asset names, content language names and future publishing in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and may in some cases be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
See "Patched versions".

### Workarounds
None.

### References
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office
GitHub Security Advisory: GHSA-2mx6-fq24-g2mh
Package: ibexa/admin-ui (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0, < 5.0.3
Patched in: 5.0.3

Summary: ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

Details:
### Impact
This security advisory resolves an XSS vulnerability in image asset names, content language names and future publishing in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and may in some cases be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
See "Patched versions".

### Workarounds
None.

### References
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office
GitHub Security Advisory: GHSA-99c7-c3mw-mxhv
Package: ezsystems/ezplatform-admin-ui (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.3.0, < 2.3.39
Patched in: 2.3.39

Summary: ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

Details:
### Impact
This security advisory resolves an XSS vulnerability in image asset names, content language names and future publishing in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and may in some cases be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless.

### Patches
See "Patched versions".

### Workarounds
None.

### References
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office
GitHub Security Advisory: GHSA-q3x8-6898-23g3
Package: ibexa/user (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 5.0.0, < 5.0.3
Patched in: 5.0.3

Summary: ibexa/user login enumerates user accounts

Details:
### Impact
In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious.

### Patches
See "Patched versions".

### Workarounds
None.

### Resources
https://developers.ibexa.co/security-advisories/ibexa-sa-2025-004-xss-and-enumeration-vulnerabilities-in-back-office
GitHub Security Advisory: GHSA-54hq-mf6h-48xh
Package: prestashop/ps_checkout (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 1.3.0, < 4.4.1
Patched in: 4.4.1

Summary: PrestaShop Checkout allows customer account takeover via email

Details:
# Impact
Missing validation on Express Checkout feature allows silent log-in

## Affected versions

The issue was introduced in PrestaShop Checkout 1.3.0 .

All versions above 1.3.0 are vulnerable except of course the patch versions published on 16/10/2025: 7.4.4.1, 8.4.4.1, 7.5.0.5, 8.5.0.5, 9.5.0.5

# Patches
The problem has been patched in versions

- v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
- v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
- v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
- v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
- v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read our [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about our build numbers and versions of PrestaShop Checkout

# Credits
We would like to thank [Léo CUNÉAZ](https://github.com/inem0o) for reporting the issue.
GitHub Security Advisory: GHSA-r9xj-mvqf-jm7w
Package: bagisto/bagisto (COMPOSER)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), CWE-87: Improper Neutralization of Alternate XSS Syntax
Vulnerable versions: <= 2.3.7
Patched in: 2.3.8

Summary: bagisto has Cross Site Scripting (XSS) in Create New Customer

Details:
### Summary
In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to reflected / stored Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin’s browser or another user viewing the customer data, enabling session theft or admin-level actions.

### Details
The vulnerability arises because certain input fields are not properly sanitized or escaped when rendering customer data in the admin UI. The form data is stored in the database (i.e. it is stored XSS), and later when customer records are displayed (e.g. in a grid, detail view, or listing), the input is interpolated into HTML without encoding or filtering. 

### PoC
Navigate to sales orders, and create a new customer.
<img width="643" height="567" alt="image" src="https://github.com/user-attachments/assets/e3a7c5a2-f53b-4db6-ac23-3451bca58956" />
Enter the payload `"><svg/onload=prompt(document.domain)>` to the first_name and last_name.
<img width="1527" height="767" alt="image" src="https://github.com/user-attachments/assets/86ac325e-7700-477d-a13d-be2d4885f510" />
Scripts were triggered.
<img width="1267" height="321" alt="image" src="https://github.com/user-attachments/assets/ce673b44-13cc-4e88-a89e-03bf0bd7e244" />
<img width="1336" height="404" alt="image" src="https://github.com/user-attachments/assets/d45913ea-b177-4926-8612-92518e12f11e" />


### Impact
Stored XSS vulnerability — malicious script persisted in database and executed when viewing the data. An attacker (with limited privilege) could inject JavaScript that runs in the browser of an admin or user who views injected customer records. The script can steal session cookies, perform actions on behalf of admin, escalate privileges, or pivot into further attacks. In an e-commerce admin system, this is high severity due to potential access to customer data, order management, or site configuration.
GitHub Security Advisory: GHSA-jqrp-58fv-w8cq
Package: bagisto/bagisto (COMPOSER)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Vulnerable versions: <= 2.3.7
Patched in: 2.3.8

Summary: bagisto has CSV Formula Injection in Create New Product

Details:
### Summary
When product data that begins with a spreadsheet formula character (for example =, +, -, or @) is accepted and later exported or saved into a CSV and opened in spreadsheet software, the spreadsheet will interpret that cell as a formula. This allows an attacker to supply a CSV field (e.g., product name) that contains a formula which may be evaluated by a victim’s spreadsheet application — potentially leading to data exfiltration and remote command execution (via older Excel exploits / OLE/cmd constructs or Excel macros).

### Details
Spreadsheet applications treat cell text that begins with characters =, +, -, @ as formulas. If unescaped, spreadsheet will interpret and evaluate the content when the file is opened. The application fails to neutralize/escape leading formula characters when generating CSV or when accepting CSV import fields for display/export.

### PoC
Insert CSV formula to the product name field, and save the changes. Export it to CSV file, open it and the calc.exe will be executed. Other CSV export functions are affected as well.
http://127.0.0.1/admin/catalog/products/edit/1
<img width="408" height="302" alt="image" src="https://github.com/user-attachments/assets/2c6fd1e3-6725-4bf4-9c64-20cd57f4e279" />
<img width="1696" height="854" alt="image" src="https://github.com/user-attachments/assets/911a69ae-65ac-4a8a-ad8e-63571a9610c8" />

### Impact
Data exfiltration: Using spreadsheet functions (e.g., WEBSERVICE, HYPERLINK, or concatenation to create requests) on victims' machines that make network calls.
Remote command execution: In some historical cases, specially crafted formulas and older Excel behaviors can lead to RCE. Modern Excel hardens many of these, but risk remains depending on environment.