hitoshura25/cvefixes huggingface dataset:
CVE-2023-1762 (PHP, published 2023-03-31T02:15Z)
Description: value: Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/user.php
Commit message: fix: privilege escalation for users with insufficient permissions


Vulnerable code:

Fixed code:
            if (!$user->isSuperAdmin()) {
                $isSuperAdmin = false;
            }

            <?php if ($user->isSuperAdmin()) { ?>
            <?php } ?>
CVE-2023-1875 (PHP, published 2023-04-22T18:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/user.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW);
            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW);

Fixed code:
            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_SANITIZE_SPECIAL_CHARS);
            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_SANITIZE_SPECIAL_CHARS);
CVE-2023-1878 (PHP, published 2023-04-05T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/stat.adminlog.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
if ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'adminlog' == $action) {
            $text = $loggingValue['text'];
} elseif ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'deleteadminlog' == $action && $deleteLog) {

Fixed code:
if ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'adminlog' === $action) {
            $text = Strings::htmlentities($loggingValue['text']);
} elseif ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'deleteadminlog' === $action && $deleteLog) {
CVE-2023-1879 (PHP, published 2023-04-05T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/category.edit.php
phpmyfaq/admin/category.main.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
    $header = $PMF_LANG['ad_categ_edit_1'] . ' "' . $categoryData->getName() . '" ' . $PMF_LANG['ad_categ_edit_2'];
                <input type="text" id="name" name="name" value="<?= $categoryData->getName() ?>"
                          class="form-control"><?= $categoryData->getDescription() ?></textarea>
                $categoryLang = Filter::filterInput(INPUT_POST, 'catlang', FILTER_UNSAFE_RAW);
                $existingImage = Filter::filterInput(INPUT_POST, 'existing_image', FILTER_UNSAFE_RAW);

Fixed code:
use phpMyFAQ\Strings;
    $header = $PMF_LANG['ad_categ_edit_1'] . ' "' . Strings::htmlentities($categoryData->getName()) .
        '" ' . $PMF_LANG['ad_categ_edit_2'];
                <input type="text" id="name" name="name" value="<?= Strings::htmlentities($categoryData->getName()) ?>"
                          class="form-control"><?= Strings::htmlentities($categoryData->getDescription()) ?></textarea>
                $categoryLang = Filter::filterInput(INPUT_POST, 'catlang', FILTER_SANITIZE_SPECIAL_CHARS);
                $existingImage = Filter::filterInput(INPUT_POST, 'existing_image', FILTER_SANITIZE_SPECIAL_CHARS);
CVE-2023-1880 (PHP, published 2023-04-05T17:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/send2friend.php
phpmyfaq/src/phpMyFAQ/Export/Html5.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
        'lang' => $faqLanguage,
use phpMyFAQ\Init;
                $this->xml->text(strip_tags($data['topic']));

Fixed code:
        'lang' => Strings::htmlentities($faqLanguage),
                $this->xml->text(Strings::htmlentities($data['topic']));
CVE-2023-1882 (PHP, published 2023-04-05T17:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/contact.php
phpmyfaq/index.php
phpmyfaq/request-removal.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
        'privacyURL' => $faqConfig->get('main.privacyURL'),
            $faqConfig->get('main.privacyURL'),
            $faqConfig->get('main.privacyURL'),
        'privacyURL' => $faqConfig->get('main.privacyURL'),

Fixed code:
        'privacyURL' => Strings::htmlentities($faqConfig->get('main.privacyURL')),
            Strings::htmlentities($faqConfig->get('main.privacyURL')),
            Strings::htmlentities($faqConfig->get('main.privacyURL')),
use phpMyFAQ\Strings;
        'privacyURL' => Strings::htmlentities($faqConfig->get('main.privacyURL')),
CVE-2023-1883 (PHP, published 2023-04-05T17:15Z)
Description: value: Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/ajaxservice.php
phpmyfaq/src/phpMyFAQ/Faq.php
Commit message: fix: added check if news or FAQs are active


Vulnerable code:
            !is_null($username) && !is_null($mailer) && !is_null($comment) && $stopWords->checkBannedWord(
                $comment
            ) && !$faq->commentDisabled(
                $id,
                $languageCode,
                $type
            )
        if ('news' == $commentType) {

Fixed code:
            !is_null($username) && !is_null($mailer) && !is_null($comment) && $stopWords->checkBannedWord($comment) &&
            !$faq->commentDisabled($id, $languageCode, $type) && !$faq->isActive($id, $languageCode, $type)
    public function isActive(int $recordId, string $recordLang, string $commentType = 'faq'): bool
    {
        if ('news' === $commentType) {
            $table = 'faqnews';
        } else {
            $table = 'faqdata';
        }

        $query = sprintf(
            "
            SELECT
                active
            FROM
                %s%s
            WHERE
                id = %d
            AND
                lang = '%s'",
            Database::getTablePrefix(),
            $table,
            $recordId,
            $this->config->getDb()->escape($recordLang)
        );

        $result = $this->config->getDb()->query($query);

        if ($row = $this->config->getDb()->fetchObject($result)) {
            return !(($row->active === 'y' || $row->active === 'yes'));
        } else {
            return true;
        }
    }

        if ('news' === $commentType) {
CVE-2023-1884 (PHP, published 2023-04-05T17:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/stopwords.php
phpmyfaq/src/phpMyFAQ/Stopwords.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
            elem_id = buildStopWordInputElemId(data[i].id, data[i].lang);
            html += buildStopWordInputElement(elem_id, data[i].stopword);
          return '<input class="form-control form-control-sm" id="' + elementId + '" value="' + stopword + '" ' + attrs + '>';
                $stopWords[] = $row->stopword;

Fixed code:
            elem_id = buildStopWordInputElemId(data[i].id, escape(data[i].lang));
            html += buildStopWordInputElement(elem_id, escape(data[i].stopword));
          return '<input class="form-control form-control-sm" id="' + elementId + '" value="' + escape(stopword) + '" ' + attrs + '>';

        const escape = (text) => {
          const map = {
            '&': '&amp;',
            '<': '&lt;',
            '>': '&gt;',
            '"': '&quot;',
            "'": '&#039;',
          };

          return text.replace(/[&<>"']/g, (mapped) => {
            return map[mapped];
          });
        };

                $stopWords[] = Strings::htmlentities($row->stopword);
CVE-2023-1885 (PHP, published 2023-04-05T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/category.main.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                    $categoryName = $cat['name'];
                    $categoryName = $cat['name'] . ' (' . $languageCodes[strtoupper($cat['lang'])] . ')';

Fixed code:
use phpMyFAQ\Strings;
                    $categoryName = Strings::htmlentities($cat['name']);
                    $categoryName = Strings::htmlentities($cat['name']) .
                        ' (' . $languageCodes[strtoupper($cat['lang'])] . ')';
CVE-2023-1886 (PHP, published 2023-04-05T17:15Z)
Description: value: Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-294 \u2014 Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/ajaxservice.php
phpmyfaq/lang/language_de.php
phpmyfaq/src/phpMyFAQ/Captcha.php
Commit message: fix: corrected check on null values


Vulnerable code:
'savevoting' !== $action && 'saveuserdata' !== $action && 'changepassword' !== $action && !is_null($code) &&
    !$captcha->checkCaptchaCode($code)
$PMF_LANG['err_SaveComment'] = "Pflichtfelder sind <strong>Name</strong>, <strong>E-Mail-Adresse</strong> und <strong>Kommentar</strong>!";
     * @param string $code Captcha Code
    public function checkCaptchaCode(string $code): bool

Fixed code:
    'savevoting' !== $action && 'saveuserdata' !== $action && 'changepassword' !== $action &&
    !$captcha->checkCaptchaCode($code ?? '')
$PMF_LANG['err_SaveComment'] = "Pflichtfelder sind Name, E-Mail-Adresse und Kommentar!";
     * @param string|null $code Captcha Code
    public function checkCaptchaCode(string $code = null): bool
CVE-2023-1887 (PHP, published 2023-04-05T17:15Z)
Description: value: Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-840 \u2014 Business Logic Errors
Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/record.add.php
Commit message: fix: corrected wrong check on user permission


Vulnerable code:
 * @package phpMyFAQ
 * @author Thorsten Rinne <thorsten@phpmyfaq.de>
 * @license http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
 * @link https://www.phpmyfaq.de
 * @since 2003-02-23
if ($user->perm->hasPermission($user->getUserId(), 'edit_faq') || $user->perm->hasPermission($user->getUserId(), 'add_faq')) {

Fixed code:
 * @package   phpMyFAQ
 * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
 * @license   http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
 * @link      https://www.phpmyfaq.de
 * @since     2003-02-23
if ($user->perm->hasPermission($user->getUserId(), 'add_faq')) {
CVE-2023-2427 (PHP, published 2023-05-05T19:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Tags.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
    private $config;
    private $recordsByTagName = [];
            $title = Strings::htmlspecialchars($taggingName, ENT_QUOTES, 'utf-8');
            $oLink->itemTitle = $taggingName;
            $oLink->text = $taggingName;

Fixed code:
    private Configuration $config;
    private array $recordsByTagName = [];
            $title = Strings::htmlentities($taggingName);
            $oLink->itemTitle = $title;
            $oLink->text = $title;
CVE-2023-2428 (PHP, published 2023-04-30T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/record.edit.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
    $faqData['title'] = (isset($faqData['title']) ? Strings::htmlspecialchars($faqData['title']) : '');
    $faqData['tags'] = (isset($faqData['tags']) ? Strings::htmlspecialchars($faqData['tags']) : '');
    $faqData['keywords'] = (isset($faqData['keywords']) ? Strings::htmlspecialchars($faqData['keywords']) : '');
    $faqData['author'] = (isset($faqData['author']) ? Strings::htmlspecialchars(
    $faqData['email'] = (isset($faqData['email']) ? Strings::htmlspecialchars($faqData['email']) : $user->getUserData(
                                <input type="hidden" name="notifyUser" id="notifyUser" value="<?= $notifyUser ?>">
                                <input type="hidden" name="notifyEmail" id="notifyEmail" value="<?= $notifyEmail ?>">

Fixed code:
    $faqData['title'] = (isset($faqData['title']) ? Strings::htmlentities($faqData['title']) : '');
    $faqData['tags'] = (isset($faqData['tags']) ? Strings::htmlentities($faqData['tags']) : '');
    $faqData['keywords'] = (isset($faqData['keywords']) ? Strings::htmlentities($faqData['keywords']) : '');
    $faqData['author'] = (isset($faqData['author']) ? Strings::htmlentities(
    $faqData['email'] = (isset($faqData['email']) ? Strings::htmlentities($faqData['email']) : $user->getUserData(
                                <input type="hidden" name="notifyUser" id="notifyUser"
                                       value="<?= Strings::htmlentities($notifyUser) ?>">
                                <input type="hidden" name="notifyEmail" id="notifyEmail"
                                       value="<?= Strings::htmlentities($notifyEmail) ?>">
CVE-2023-2429 (PHP, published 2023-04-30T03:15Z)
Description: value: Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/ajaxservice.php
phpmyfaq/src/phpMyFAQ/User.php
Commit message: fix: avoid possible email address manipulation


Vulnerable code:
        return (int)$userData['user_id'];

Fixed code:
        if ($userId !== $user->getUserIdByEmail($email)) {
            $message = ['error' => 'User ID / email mismatch!'];
            break;
        }

        return $userData['user_id'];
CVE-2023-2550 (PHP, published 2023-05-05T20:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/record.questions.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                      <a href="mailto:<?= $openQuestion->getEmail() ?>">
                      <strong><?= $category->categoryName[$openQuestion->getCategoryId()]['name'] ?></strong>

Fixed code:
                      <a href="mailto:<?= Strings::htmlentities($openQuestion->getEmail()) ?>">
                      <strong>
                          <?= Strings::htmlentities($category->categoryName[$openQuestion->getCategoryId()]['name']) ?>
                      </strong>
CVE-2023-2752 (PHP, published 2023-05-17T08:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/faq.php
phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php
tests/phpMyFAQ/Helper/FaqHelperTest.php
Commit message: fix: cleanup content before sending it to the user


Vulnerable code:

Fixed code:
$answer = $faqHelper->cleanUpContent($answer);

use DOMDocument;

    /**
     * Remove <script> tags, we don't need them
     *
     * @param string $content
     * @return string
     */
    public function cleanUpContent(string $content): string
    {
        $document = new DOMDocument();
        $document->loadHTML($content, LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD);

        $scriptTags = $document->getElementsByTagName('script');

        for ($i = 0; $i < $scriptTags->length; $i++) {
            $scriptTags->item($i)->parentNode->removeChild($scriptTags->item($i));
        }

        return preg_replace(['/\r/', '/\n/'], '', $document->saveHTML());
    }

    public function testCleanUpContent(): void
    {
        $content = '<p>Some text <script>alert("Hello, world!");</script></p>';
        $expectedOutput = '<p>Some text </p>';

        $actualOutput = $this->faqHelper->cleanUpContent($content);

        $this->assertEquals($expectedOutput, $actualOutput);
    }
CVE-2023-2753 (PHP, published 2023-05-17T08:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php
tests/phpMyFAQ/Helper/FaqHelperTest.php
Commit message: fix: remove HTML event attributes


Vulnerable code:
        return preg_replace(['/\r/', '/\n/'], '', $document->saveHTML());
        $content = '<p>Some text <script>alert("Hello, world!");</script></p>';
        $expectedOutput = '<p>Some text </p>';

Fixed code:
use DOMXPath;
        $xpath = new DOMXPath($document);
        $onAttributes = $xpath->query("//*/@*[starts-with(name(), 'on')]");
        foreach ($onAttributes as $onAttribute) {
            $onAttribute->ownerElement->removeAttributeNode($onAttribute);
        }

        $body = $xpath->query('body')->item(0);

        return preg_replace(['/\r/', '/\n/'], '', $document->saveHTML($body));
        $content = '<p>Some text <script>alert("Hello, world!");</script><img src=foo onerror=alert(document.cookie)></p>';
        $expectedOutput = '<p>Some text <img src="foo"></p>';
CVE-2023-2998 (PHP, published 2023-05-31T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.14.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/News.php
Commit message: fix: strip tags for news on startpage


Vulnerable code:
            $output .= sprintf('%s', $item['content']);
    public function getLatestData($showArchive = false, $active = true, $forceConfLimit = false): array

Fixed code:
            $output .= sprintf('%s', strip_tags($item['content']));
    public function getLatestData(bool $showArchive = false, bool $active = true, bool $forceConfLimit = false): array