deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-h369-cpjj-qfff
Package: phppgadmin/phppgadmin (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 7.13.0
Patched in: unpatched

Summary: phppgadmin vulnerable to Cross-site Scripting

Details:
phpPgAdmin versions 7.13.0 and earlier contain multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied inputs from $_REQUEST parameters are reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspecified files. An attacker can exploit these vulnerabilities to execute arbitrary JavaScript in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious actions.
GitHub Security Advisory: GHSA-2jm2-2p35-rp3j
Package: devcode-it/openstamanager (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 2.9.4
Patched in: 2.9.5

Summary: OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter

Details:
### Summary
An authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the `display` parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise.

### Details
The vulnerability is located in the `retrieve()` method within `src/API/Manager.php`.

User input from the `display` GET parameter is processed without proper validation. The code strips the surrounding brackets `[]`, splits the string by commas, and then passes each resulting element directly into the `selectRaw()` function of the query builder.

```php
// User input from 'display' is taken without sanitization.
$select = !empty($request['display']) ? explode(',', substr((string) $request['display'], 1, -1)) : null;

// ...

// The unsanitized input is passed directly to `selectRaw()`.
foreach ($select as $s) {
    $query->selectRaw($s);
}
```

Since `selectRaw()` is designed to execute raw SQL expressions, it executes any malicious SQL code provided in the `display` parameter.

### PoC
1.  Log in to an OpenSTAManager instance as any user.
2.  Navigate to the user's profile page to obtain their personal API Token.
3.  Use this API token to send a specially crafted GET request to the API endpoint.

**Time-Based Blind Injection Test:**

Replace `<your_host>`, `<your_token>`, and `<resource_name>` with your actual values. `anagrafiche` is a valid resource.

```bash
curl "http://<your_host>/openstamanager/api?token=<your_token>&resource=anagrafiche&display=[1,SLEEP(5)]"
```

The server will delay its response by approximately 5 seconds, confirming the `SLEEP(5)` command was executed by the database.

### Impact
This is a critical SQL Injection vulnerability. Any authenticated user, even those with the lowest privileges, can exploit this vulnerability to:

*   **Exfiltrate all data** from the database (e.g., user credentials, customer information, invoices, internal data).
*   **Modify or delete data**, compromising data integrity.
*   Potentially achieve further system compromise, depending on the database user's privileges and system configuration.
GitHub Security Advisory: GHSA-mwcc-7vpp-xmv9
Package: mongodb/mongodb-extension (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-825: Expired Pointer Dereference
Vulnerable versions: < 1.21.2
Patched in: 1.21.2

Summary: MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory

Details:
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
GitHub Security Advisory: GHSA-9jrw-jrrj-p6fr
Package: drupal/email_tfa (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Vulnerable versions: < 2.0.6
Patched in: 2.0.6

Summary: Drupal Email TFA allows Functionality Bypass

Details:
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass. This issue affects Email TFA: from 0.0.0 before 2.0.6.
GitHub Security Advisory: GHSA-vc4f-2g7f-pmqr
Package: munkireport/comment (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.0
Patched in: 4.0

Summary: MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment

Details:
A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment.
GitHub Security Advisory: GHSA-ffpg-gm3h-4p5p
Package: backdrop/backdrop (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect'), CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax
Vulnerable versions: <= 1.32.0
Patched in: unpatched

Summary: Backdrop CMS Host Header Injection vulnerability

Details:
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.
GitHub Security Advisory: GHSA-mhpg-hpj5-73r2
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-525: Use of Web Browser Cache Containing Sensitive Information
Vulnerable versions: >= 11.2.0, < 11.2.8
Patched in: 11.2.8

Summary: Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

Details:
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
GitHub Security Advisory: GHSA-mhpg-hpj5-73r2
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-525: Use of Web Browser Cache Containing Sensitive Information
Vulnerable versions: >= 11.0.0, < 11.1.9
Patched in: 11.1.9

Summary: Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

Details:
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
GitHub Security Advisory: GHSA-mhpg-hpj5-73r2
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-525: Use of Web Browser Cache Containing Sensitive Information
Vulnerable versions: >= 10.5.0, < 10.5.6
Patched in: 10.5.6

Summary: Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

Details:
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
GitHub Security Advisory: GHSA-mhpg-hpj5-73r2
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-525: Use of Web Browser Cache Containing Sensitive Information
Vulnerable versions: >= 8.0.0, < 10.4.9
Patched in: 10.4.9

Summary: Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

Details:
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
GitHub Security Advisory: GHSA-h89p-5896-f4q8
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Vulnerable versions: >= 11.2.0, < 11.2.8
Patched in: 11.2.8

Summary: Drupal core allows Content Spoofing

Details:
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-h89p-5896-f4q8
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Vulnerable versions: >= 11.0.0, < 11.1.9
Patched in: 11.1.9

Summary: Drupal core allows Content Spoofing

Details:
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-h89p-5896-f4q8
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Vulnerable versions: >= 10.5.0, < 10.5.6
Patched in: 10.5.6

Summary: Drupal core allows Content Spoofing

Details:
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-h89p-5896-f4q8
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Vulnerable versions: >= 8.0.0, < 10.4.9
Patched in: 10.4.9

Summary: Drupal core allows Content Spoofing

Details:
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-m6vv-vcj8-w8m7
Package: drupal/core (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-502: Deserialization of Untrusted Data, CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: >= 11.2.0, < 11.2.8
Patched in: 11.2.8

Summary: Drupal core allows Object Injection

Details:
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-m6vv-vcj8-w8m7
Package: drupal/core (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-502: Deserialization of Untrusted Data, CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: >= 11.0.0, < 11.1.9
Patched in: 11.1.9

Summary: Drupal core allows Object Injection

Details:
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-m6vv-vcj8-w8m7
Package: drupal/core (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-502: Deserialization of Untrusted Data, CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: >= 10.5.0, < 10.5.6
Patched in: 10.5.6

Summary: Drupal core allows Object Injection

Details:
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-m6vv-vcj8-w8m7
Package: drupal/core (COMPOSER)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-502: Deserialization of Untrusted Data, CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: >= 8.0.0, < 10.4.9
Patched in: 10.4.9

Summary: Drupal core allows Object Injection

Details:
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-83v7-c2cf-p9c2
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 11.2.0, < 11.2.8
Patched in: 11.2.8

Summary: Drupal core allows Forceful Browsing

Details:
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-83v7-c2cf-p9c2
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 11.0.0, < 11.1.9
Patched in: 11.1.9

Summary: Drupal core allows Forceful Browsing

Details:
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-83v7-c2cf-p9c2
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 10.5.0, < 10.5.6
Patched in: 10.5.6

Summary: Drupal core allows Forceful Browsing

Details:
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-83v7-c2cf-p9c2
Package: drupal/core (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 8.0.0, < 10.4.9
Patched in: 10.4.9

Summary: Drupal core allows Forceful Browsing

Details:
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
GitHub Security Advisory: GHSA-gg35-374m-9ph8
Package: drupal/simple_multistep (COMPOSER)
Severity: LOW (CVSS 3.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Drupal Simple multi step form allows Cross-Site Scripting

Details:
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.
GitHub Security Advisory: GHSA-5mrf-j8v6-f45g
Package: librenms/librenms (COMPOSER)
Severity: LOW (CVSS 3.7)
CWE: CWE-521: Weak Password Requirements
Vulnerable versions: < 25.11.0
Patched in: 25.11.0

Summary: LibreNMS has Weak Password Policy

Details:
## Summary

A **Weak Password Policy** vulnerability was identified in the user management functionality of the _LibreNMS_ application. This vulnerability allows administrators to create accounts with extremely weak and predictable passwords, such as `12345678`. This exposes the platform to brute-force and credential stuffing attacks.

---

## Details

**Vulnerable Component:** User creation / password definition

The application fails to enforce a strong password policy when creating new users. As a result, administrators can define trivial and well-known weak passwords, compromising the authentication security of the system.

---

## PoC

1. Log in to the application using an **Administrator** account.
    
2. Navigate to the user management section:  
      
3. Create a new user account using the password `12345678`.
    

<img width="1103" height="852" alt="image" src="https://github.com/user-attachments/assets/a20d4226-9f86-46ee-a4e6-45be91bb6b7b" />

4. The application accepts the weak password without restrictions and creates the account successfully.
    
<img width="1359" height="487" alt="image" src="https://github.com/user-attachments/assets/9bec15bf-b38f-448b-8f98-acca5724e143" />

---

## Impact

Weak password policy vulnerabilities can have severe consequences, including:

- Increased risk of brute-force and credential stuffing attacks
    
- Unauthorized access to user or administrative accounts
    
- Privilege escalation through compromised credentials
    
- Degradation of the overall security posture of the platform
    

---

## Mitigation

- Enforce a strong password policy (e.g., minimum of 12 characters with uppercase, lowercase, digits, and special characters).
    
- Block the use of commonly known weak passwords (e.g., `12345678`, `password`, `admin`, `qwerty`).
GitHub Security Advisory: GHSA-84hf-8gh5-575j
Package: getkirby/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0.0, < 5.1.4
Patched in: 5.1.4

Summary: Kirby CMS has cross-site scripting (XSS) in the changes dialog

Details:
### TL;DR

This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames.

The attack requires user interaction by another Panel user and *cannot* be automated.

----

### Introduction

Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.

Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.

### Impact

The "Changes" dialog in the Panel displays all content models (pages, files, users) with changed content, i.e. with content that has not yet been published. Each changed model is listed with its preview image/icon and its title/name.

Attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the "Changes" dialog. If another authenticated user subsequently opened the dialog in their Panel, the malicious code would be executed.

### Patches

The problem has been patched in [Kirby 5.1.4](https://github.com/getkirby/kirby/releases/tag/5.1.4). Please update to this or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.

In the patch release, we have added the required escaping code to signal to the browser the intent of displaying plain text instead of code in the places where the model titles are rendered.
GitHub Security Advisory: GHSA-49qv-h8pm-73pf
Package: codingms/modules (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 6.0.0, < 6.4.2
Patched in: 6.4.2

Summary: TYPO3 Modules Extension has Improper Authentication vulnerability 

Details:
Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules. This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.
GitHub Security Advisory: GHSA-49qv-h8pm-73pf
Package: codingms/modules (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 7.0.0, < 7.5.5
Patched in: 7.5.5

Summary: TYPO3 Modules Extension has Improper Authentication vulnerability 

Details:
Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules. This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.
GitHub Security Advisory: GHSA-49qv-h8pm-73pf
Package: codingms/modules (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 5.0.0, < 5.7.4
Patched in: 5.7.4

Summary: TYPO3 Modules Extension has Improper Authentication vulnerability 

Details:
Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules. This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.
GitHub Security Advisory: GHSA-49qv-h8pm-73pf
Package: codingms/modules (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 4.3.11
Patched in: 4.3.11

Summary: TYPO3 Modules Extension has Improper Authentication vulnerability 

Details:
Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules. This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.
GitHub Security Advisory: GHSA-2w46-vq8h-98vh
Package: shopware/core (COMPOSER)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Vulnerable versions: >= 6.7.0.0, < 6.7.4.1
Patched in: 6.7.4.1

Summary: Shopware 6's password recovery link does not expire after email change

Details:
### Summary
When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.

### PoC

1. Log in to a Shopware account.
2. Request a password reset for your current email address.
3. Copy the password reset link but do not open it.
4. Log back into your account.n
5. Navigate to Account Settings → Email and change your email address.
6. Use the previously copied reset link (from before the email change).
7. The system allows password change using the old link.

### Impact
Reproduced on Stable 6.6.10.7 and trunk.
GitHub Security Advisory: GHSA-2w46-vq8h-98vh
Package: shopware/core (COMPOSER)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Vulnerable versions: < 6.6.10.9
Patched in: 6.6.10.9

Summary: Shopware 6's password recovery link does not expire after email change

Details:
### Summary
When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.

### PoC

1. Log in to a Shopware account.
2. Request a password reset for your current email address.
3. Copy the password reset link but do not open it.
4. Log back into your account.n
5. Navigate to Account Settings → Email and change your email address.
6. Use the previously copied reset link (from before the email change).
7. The system allows password change using the old link.

### Impact
Reproduced on Stable 6.6.10.7 and trunk.