hitoshura25/cvefixes huggingface dataset:
CVE-2023-3469 (PHP, published 2023-06-30T01:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/backup.import.php
phpmyfaq/src/phpMyFAQ/Core/Error.php
Commit message: fix: added missing conversion of HTML entities in error exception


Vulnerable code:
        $versionExpected = '-- pmf' . substr((string) $faqConfig->getVersion(), 0, 3);
        } else {
        if ($ok == 1) {
        echo "<p>Message: '" . $exception->getMessage() . "'</p>";

Fixed code:
        $versionExpected = '-- pmf' . substr($faqConfig->getVersion(), 0, 3);
                echo 'This file is not a verified backup file.<br>';
        }

        if ($ok === 1) {
        if ($ok === 1) {
        } else {
            echo Alert::danger('ad_csv_no', 'Import not possible.');
use phpMyFAQ\Strings;
        echo "<p>Message: '" . Strings::htmlentities($exception->getMessage()) . "'</p>";
CVE-2023-4006 (PHP, published 2023-07-31T01:15Z)
Description: value: Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/report.export.php
phpmyfaq/src/phpMyFAQ/Report.php
tests/phpMyFAQ/ReportTest.php
Commit message: fix: added sanitizer for CSV


Vulnerable code:
        $content .= implode(';', $row);
    private $config;

Fixed code:
        $csvRow = array_map(['phpMyFAQ\Report', 'sanitize'], $row);
        $content .= implode(';', $csvRow);
    private Configuration $config;

    /**
     * Sanitizes input to avoid CSV injection.
     * @param string|int $value
     * @return string
     */
    public static function sanitize($value): string
    {
        if (preg_match('/[=\+\-\@\|]/', $value)) {
            $value = '"' . str_replace('"', '""', $value) . '"';
        }

        return $value;
    }
<?php

namespace phpMyFAQ;

use PHPUnit\Framework\TestCase;

class ReportTest extends TestCase
{

    public function testSanitize(): void
    {
        $data = [
            ['John Doe', 'john.doe@example.com', '12345'],
            ['Jane Smith', 'jane.smith@example.com', '=SUM(A1:A10)'],
        ];

        $actual = [];

        $expected = [
            'John Doe,"john.doe@example.com",12345',
            'Jane Smith,"jane.smith@example.com","=SUM(A1:A10)"'
        ];

        foreach ($data as $row) {
            $csvRow = array_map(['phpMyFAQ\Report', 'sanitize'], $row);
            $actual[] = implode(',', $csvRow);
        }

        $this->assertEquals($expected, $actual);
    }
}
CVE-2023-4007 (PHP, published 2023-07-31T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Link.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
            $htmlAnchor .= sprintf(' title="%s"', addslashes($this->tooltip));
            $htmlAnchor .= sprintf(' name="%s"', $this->name);
            $htmlAnchor .= $this->text;
                $htmlAnchor .= $this->name;

Fixed code:
            $htmlAnchor .= sprintf(' title="%s"', Strings::htmlentities($this->tooltip));
            $htmlAnchor .= sprintf(' name="%s"', Strings::htmlentities($this->name));
            $htmlAnchor .= Strings::htmlentities($this->text);
                $htmlAnchor .= Strings::htmlentities($this->name);
CVE-2023-5227 (PHP, published 2023-09-30T01:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Category/CategoryImage.php
Commit message: feat: added check for valid image MIME types


Vulnerable code:
            if (false === getimagesize($this->uploadedFile['tmp_name'])) {
            if (move_uploaded_file($this->uploadedFile['tmp_name'], self::UPLOAD_DIR . $this->fileName)) {
                return true;
            } else {

Fixed code:
    /**
     * Checks for valid image MIME types, returns true if valid
     * @param string $file
     * @return bool
     */
    private function isValidMimeType(string $file): bool
    {
        $types = ['image/jpeg','image/gif','image/png'];
        $type = mime_content_type($file);

        return in_array($type, $types);
    }

            if (!getimagesize($this->uploadedFile['tmp_name'])) {
                return false;
            }

            if (!$this->isValidMimeType($this->uploadedFile['tmp_name'])) {

            if (!move_uploaded_file($this->uploadedFile['tmp_name'], self::UPLOAD_DIR . $this->fileName)) {

            return true;
CVE-2023-5316 (PHP, published 2023-09-30T01:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/ajax.config_list.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                $value
                $faqConfig->get($key)

Fixed code:
use phpMyFAQ\Strings;
                Strings::htmlentities($value)
                Strings::htmlentities($faqConfig->get($key))
CVE-2023-5317 (PHP, published 2023-09-30T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/ajax.config.php
phpmyfaq/admin/instances.php
Commit message: fix: allow only valid URLs for instances


Vulnerable code:
        $updatedData['url'] = Filter::filterInput(INPUT_POST, 'url', FILTER_UNSAFE_RAW);
        if ($updatedClient->updateInstance($instanceId, $updatedData)) {
                try {
                    $updatedClient->moveClientFolder($originalData->url, $updatedData['url']);
                    $updatedClient->deleteClientFolder($originalData->url);
                } catch (Exception $e) {
                    // handle exception
                }
        } else {

Fixed code:
        $url = 'https://' . $url . '.' . $_SERVER['SERVER_NAME'];
        if (!Filter::filterVar($url, FILTER_VALIDATE_URL)) {
            $http->setStatus(400);
            $http->sendJsonWithHeaders(['error' => 'Cannot create instance: wrong URL']);
            exit(1);
        }

        $updatedData['url'] = Filter::filterInput(INPUT_POST, 'url', FILTER_VALIDATE_URL);
        if (is_null($updatedData['url'])) {
            printf(
                '<p class="alert alert-danger">%s%s<br/>%s</p>',
                '<a class="close" data-dismiss="alert" href="#">&times;</a>',
                $PMF_LANG['ad_entryins_fail'],
                 $faqConfig->getDb()->error()
            );
        } else {
          if ($updatedClient->updateInstance($instanceId, $updatedData)) {
              try {
                $updatedClient->moveClientFolder($originalData->url, $updatedData['url']);
                $updatedClient->deleteClientFolder($originalData->url);
              } catch (Exception $e) {
                // handle exception
              }
          } else {
          }
CVE-2023-5319 (PHP, published 2023-09-30T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/ajax.user.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:

Fixed code:
            $userdata['display_name'] = Strings::htmlentities($userdata['display_name']);
CVE-2023-5320 (PHP, published 2023-09-30T01:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.18.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/ajax.config_list.php
phpmyfaq/admin/configuration.php
Commit message: fix: only URLs should be allowed


Vulnerable code:
                  $type = 'text';
                  break;

Fixed code:
                    $type = 'text';
                    break;
        if (
            isset($editData['edit']['main.referenceURL']) &&
            is_null(Filter::filterVar($editData['edit']['main.referenceURL'], FILTER_VALIDATE_URL))
        ) {
            unset($editData['edit']['main.referenceURL']);
        }
CVE-2023-5863 (PHP, published 2023-10-31T01:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/login.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                                               value="<?= $request->query->get('action') ?>">

Fixed code:
use phpMyFAQ\Strings;
                                               value="<?= Strings::htmlentities($request->query->get('action')) ?>">
CVE-2023-5864 (PHP, published 2023-10-31T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Faq.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                $title = $row->question;

Fixed code:
                $title = Strings::htmlentities($row->question);
CVE-2023-5865 (PHP, published 2023-10-31T01:15Z)
Description: value: Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/api/user.php
phpmyfaq/admin/assets/src/user/user-list.js
phpmyfaq/admin/user.php
phpmyfaq/src/phpMyFAQ/User.php
Commit message: fix: terminate user sessions for user with changed permissions


Vulnerable code:

            if (!Token::getInstance()->verifyToken('user', $postData->csrfToken)) {
  fetch('index.php?action=ajax&ajax=user&ajaxaction=delete_user', {

Fixed code:
            if (!Token::getInstance()->verifyToken('activate-user', $postData->csrfToken)) {
  fetch('index.php?action=ajax&ajax=user&ajaxaction=activate_user', {

            // Terminate session in case of different permissions after the update
            $user->terminateSessionId();

    /**
     * Terminates the session ID of user
     * @return bool
     */
    public function terminateSessionId(): bool
    {
        $update = sprintf(
            "UPDATE %sfaquser SET session_id = '' WHERE user_id = %d",
            Database::getTablePrefix(),
            $this->userId
        );

        return (bool) $this->config->getDb()->query($update);
    }
CVE-2023-5866 (PHP, published 2023-10-31T01:15Z)
Description: value: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1.
Severity: nan (CVSS v3 base score: 5.7)
Weakness: CWE-614 \u2014 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Session.php
phpmyfaq/src/phpMyFAQ/Session/Token.php
Commit message: fix: improved check on secure flag for cookies


Vulnerable code:
        $secure = false;
        if (isset($_SERVER['HTTPS']) && strtoupper((string) $_SERVER['HTTPS']) === 'ON') {
            $secure = true;
        }
        setcookie($token->getCookieName($page), $token->getCookieToken(), ['expires' => $token->getExpiry()]);

Fixed code:
        $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || $_SERVER['SERVER_PORT'] === 443;
use phpMyFAQ\Configuration;
use phpMyFAQ\System;
        setcookie(
            $token->getCookieName($page),
            $token->getCookieToken(),
            [
                'expires' => $token->getExpiry(),
                'path' => dirname((string) $_SERVER['SCRIPT_NAME']),
                'domain' => parse_url(Configuration::getConfigurationInstance()->getDefaultUrl(), PHP_URL_HOST),
                'samesite' => 'strict',
                'secure' => $this->isSecure(),
                'httponly' => true,
            ]
        );

    private function isSecure(): bool
    {
        return (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || $_SERVER['SERVER_PORT'] === 443;
    }
CVE-2023-5867 (PHP, published 2023-10-31T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/record.edit.php
phpmyfaq/src/phpMyFAQ/Helper/AttachmentHelper.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                                                        $att->getFilename()
                $attachment->getFilename()

Fixed code:
                                                        Strings::htmlentities($att->getFilename())
use phpMyFAQ\Strings;
                Strings::htmlentities($attachment->getFilename())
CVE-2023-6889 (PHP, published 2023-12-16T09:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/ajax.tags.php
phpmyfaq/admin/assets/js/tags.js
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                    $currentTag->tagName = $tagName;
      input.replaceWith('<span data-tag-id="' + id + '">' + input.val().replace(/\//g, '&#x2F;') + '</span>');
    const escape = (unsafe) => {
      return unsafe.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
    }


Fixed code:
use phpMyFAQ\Strings;
                    $currentTag->tagName = Strings::htmlentities($tagName);
      input.replaceWith('<span data-tag-id="' + id + '">' + escape(input.val().replace(/\//g, '&#x2F;')) + '</span>');

  const escape = (unsafe) => {
    return unsafe.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
  }
CVE-2023-6890 (PHP, published 2023-12-16T09:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php
phpmyfaq/src/phpMyFAQ/Helper/SearchHelper.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                    $output .= sprintf('<h3>%s</h3>', $category->getPath($data['category_id'], ' &raquo; '));
                $output .= sprintf('<article>%s</article>', $data['content']);
                $oLink->text = $question;
                $oLink->itemTitle = $oLink->tooltip = $result->question;
                    $categoryInfo[0]['name'],

Fixed code:
                    $output .= sprintf(
                        '<h3>%s</h3>',
                        $this->cleanUpContent(
                            $this->cleanUpContent($category->getPath($data['category_id'], ' &raquo; '))
                        )
                    );
                $output .= sprintf('<article>%s</article>', $this->cleanUpContent($data['content']));
                $oLink->text = Strings::htmlentities($question);
                $oLink->itemTitle = $oLink->tooltip = Strings::htmlentities($result->question);
                    Strings::htmlentities($categoryInfo[0]['name']),
CVE-2024-34070 (PHP, published 2024-05-14T15:38Z)
Description: value: Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting (XSS) vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on the Login attempt, which will then be executed when viewed by the Administrator in the System Logs.  By exploiting this vulnerability, the attacker can perform various malicious actions such as forcing the Administrator to execute actions without their knowledge or consent. For instance, the attacker can force the Administrator to add a new administrator controlled by the attacker, thereby giving the attacker full control over the application. This vulnerability is fixed in 2.1.9.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/froxlor/Froxlor
Files changed:
index.php
lib/Froxlor/Api/Commands/SysLog.php
lib/Froxlor/FroxlorLogger.php
Commit message: Merge pull request from GHSA-x525-54hf-xr53

* do not log unvalidated user-input to mysql-log (if enabled)

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

* clean log-text to only allow a subset of special characters

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

* clean log-text when selecting from database to avoid possible previously added malicious entries

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

---------

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Vulnerable code:
				$rstlog->logAction(FroxlorLogger::LOGIN_ACTION, LOG_WARNING, "Unknown user '" . $loginname . "' tried to login.");
			$rstlog->logAction(FroxlorLogger::LOGIN_ACTION, LOG_WARNING, "User '" . $loginname . "' tried to login with wrong password.");
							$rstlog->logAction(FroxlorLogger::USR_ACTION, LOG_WARNING, "User '" . $loginname . "' requested to set a new password, but was not found in database!");

Fixed code:
				$rstlog->logAction(FroxlorLogger::LOGIN_ACTION, LOG_WARNING, "Unknown user tried to login.");
			$rstlog->logAction(FroxlorLogger::LOGIN_ACTION, LOG_WARNING, "User tried to login with wrong password.");
							$rstlog->logAction(FroxlorLogger::USR_ACTION, LOG_WARNING, "Unknown user requested to set a new password, but was not found in database!");
			// clean log-text
			$row['text'] = preg_replace("/[^\w @#\"':.()\[\]+\-_\/\\\!]/i", "_", $row['text']);
		// clean log-text
		$text = preg_replace("/[^\w @#\"':.()\[\]+\-_\/\\\!]/i", "_", $text);
CVE-2024-32866 (TypeScript, published 2024-04-23T21:15Z)
Description: value: Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/edmundhung/conform
Files changed:
packages/conform-dom/formdata.ts
Commit message: Merge pull request from GHSA-624g-8qjg-8qxf



Vulnerable code:
			if (typeof segment !== 'undefined' && segment !== '') {
				? pointer[key] ?? (typeof nextKey === 'number' ? [] : {})

Fixed code:
			if (
				typeof segment !== 'undefined' &&
				segment !== '' &&
				segment !== '__proto__' &&
				segment !== 'constructor' &&
				segment !== 'prototype'
			) {
				? Object.hasOwn(pointer, key)
					? pointer[key]
					: typeof nextKey === 'number'
					? []
					: {}
		if (!Object.hasOwn(pointer, path)) {
			return;
		}