hitoshura25/cvefixes huggingface dataset:
CVE-2023-0310 (PHP, published 2023-01-15T22:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/record.comments.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                        <?= $faqComment->getUsername() ?>
                </span><br/>
                    <?= $faqComment->getComment() ?>

Fixed code:
use phpMyFAQ\Strings;
                        <?= Strings::htmlentities($faqComment->getUsername()) ?>
                </span><br>
                    <?= Strings::htmlentities($faqComment->getComment()) ?>
CVE-2023-0311 (PHP, published 2023-01-15T22:15Z)
Description: value: Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Captcha.php
Commit message: fix: check captcha length correctly and fix type error


Vulnerable code:
        $w2 = $this->width / ($codeLength + 1);
        if (0 === Strings::strlen($captchaCode)) {

Fixed code:
        $w2 = floor($this->width / ($codeLength + 1));
        if (Strings::strlen($captchaCode) !== $this->captchaLength) {
CVE-2023-0312 (PHP, published 2023-01-15T22:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/add.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
 * @package phpMyFAQ
 * @author Thorsten Rinne <thorsten@phpmyfaq.de>
 * @license http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
 * @link https://www.phpmyfaq.de
 * @since 2002-09-16
    $question = $oQuestion['question'];

Fixed code:
 * @package   phpMyFAQ
 * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
 * @license   http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
 * @link      https://www.phpmyfaq.de
 * @since     2002-09-16
    $question = Strings::htmlentities($oQuestion['question']);
CVE-2023-0314 (PHP, published 2023-01-15T22:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/index.php
Commit message: fix: added missing check on redirect value


Vulnerable code:
$redirectAction = Filter::filterInput(INPUT_POST, 'redirect-action', FILTER_UNSAFE_RAW);

Fixed code:
$redirectAction = Filter::filterInput(INPUT_POST, 'redirect-action', FILTER_SANITIZE_SPECIAL_CHARS);
CVE-2023-0786 (PHP, published 2023-02-12T14:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/report.view.php
phpmyfaq/src/phpMyFAQ/Report.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                printf('<td>%s</td>', $data['category_name']);
                printf('<td>%s</td>', $data['category_name']);
            printf('<td>%s</td>', $data['faq_question']);
            printf('<td>%s</td>', $data['faq_org_author']);
            printf('<td>%s</td>', $data['faq_last_author']);
        $outputString = str_replace($toBeRemoved, '', $outputString);

        return $outputString;

Fixed code:
use phpMyFAQ\Strings;
                printf('<td>%s</td>', Strings::htmlentities($data['category_name'] ?? ''));
                printf('<td>%s</td>', Strings::htmlentities($data['category_name']));
            printf('<td>%s</td>', Strings::htmlentities($data['faq_question']));
            printf('<td>%s</td>', Strings::htmlentities($data['faq_org_author']));
            printf('<td>%s</td>', Strings::htmlentities($data['faq_last_author'] ?? ''));
        return str_replace($toBeRemoved, '', $outputString);
CVE-2023-0787 (PHP, published 2023-02-12T14:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Faq.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
            "
            SELECT
                COUNT(id) AS num
            FROM
                %sfaqquestions
            WHERE
                lang = '%s'
            AND
                is_visible != 'Y'",
            "
            SELECT
                *
            FROM
                %sfaqquestions
            WHERE
                lang = '%s'
            AND
                is_visible = 'Y'
            ORDER BY
                created ASC",
                    $row->username
                    strip_tags($row->question)

Fixed code:
            "SELECT COUNT(id) AS num FROM %sfaqquestions WHERE lang = '%s' AND is_visible != 'Y'",
            "SELECT * FROM %sfaqquestions WHERE lang = '%s' AND is_visible = 'Y' ORDER BY created ASC",
                    Strings::htmlentities($row->username)
                    Strings::htmlentities($row->question)
CVE-2023-0788 (PHP, published 2023-02-12T14:15Z)
Description: value: Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/ajaxservice.php
Commit message: fix: strip tags for questions


Vulnerable code:

Fixed code:
        $question = strip_tags($question);
CVE-2023-0789 (PHP, published 2023-02-12T14:15Z)
Description: value: Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/ajaxservice.php
Commit message: fix: strip tags for questions and answers


Vulnerable code:

Fixed code:
        $question = strip_tags($question);
            $answer = strip_tags($answer);
CVE-2023-0791 (PHP, published 2023-02-12T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/instances.php
Commit message: fix: added missing escaping of newly added values


Vulnerable code:
              '<td>' + instance + '</td>' +
              '<td>' + comment + '</td>' +

Fixed code:
        const escape = (unsafe) => {
          return unsafe.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
        }

              '<td>' + escape(instance) + '</td>' +
              '<td>' + escape(comment) + '</td>' +
CVE-2023-0792 (PHP, published 2023-02-12T14:15Z)
Description: value: Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/assets/js/tags.js
phpmyfaq/admin/tags.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
        input.replaceWith('<span data-tag-id="' + id + '">' + input.val().replace(/\//g, '&#x2F;') + '</span>');
            if (count($tagData)) {
                echo '<td><span data-tag-id="' . $key . '">' . Strings::htmlspecialchars($tag) . '</span></td>';

Fixed code:
    const escape = (unsafe) => {
      return unsafe.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
    }

        input.replaceWith('<span data-tag-id="' + id + '">' + escape(input.val().replace(/\//g, '&#x2F;')) + '</span>');
            if (count($tagData) === 0) {
                echo '<td><span data-tag-id="' . $key . '">' . Strings::htmlentities($tag) . '</span></td>';
CVE-2023-0793 (PHP, published 2023-02-12T14:15Z)
Description: value: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/ajax.user.php
phpmyfaq/admin/assets/js/user.js
phpmyfaq/admin/user.php
Commit message: fix: added missing check on password length


Vulnerable code:
                    <input type="password" autocomplete="off" name="npass" id="npass" class="form-control" required>
                    <input type="password" autocomplete="off" name="bpass" id="bpass" class="form-control" required>
                         autocomplete="off" tabindex="4">
                         class="form-control" autocomplete="off" tabindex="5">

Fixed code:
            $automaticPassword = Filter::filterVar($postData['automaticPassword'], FILTER_VALIDATE_BOOLEAN);
            if (!$automaticPassword) {
                if (strlen($userPassword) <= 7 || strlen($userPasswordConfirm) <= 7) {
                    $errorMessage[] = $PMF_LANG['ad_passwd_fail'];
                }
            }

            if (strlen($newPassword) <= 7 || strlen($retypedPassword) <= 7) {
                $http->setStatus(400);
                $http->sendJsonWithHeaders(['error' => $PMF_LANG['ad_passwd_fail']]);
                exit(1);
            }

      const automaticPassword = document.getElementById('add_user_automatic_password').checked;
        automaticPassword,
                    <input type="password" autocomplete="off" name="npass" id="npass" class="form-control" minlength="8"
                           required>
                    <input type="password" autocomplete="off" name="bpass" id="bpass" class="form-control" minlength="8"
                           required>
                         minlength="8" autocomplete="off" tabindex="4">
                         minlength="8" class="form-control" autocomplete="off" tabindex="5">
CVE-2023-0794 (PHP, published 2023-02-12T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/header.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                      <?= $user->getUserData('display_name'); ?>

Fixed code:
                      <?= Strings::htmlentities($user->getUserData('display_name')) ?>
CVE-2023-0880 (PHP, published 2023-02-17T03:15Z)
Description: value: Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-115 \u2014 Misinterpretation of Input
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/ajaxservice.php
Commit message: fix: added trim to avoid questions with a single space


Vulnerable code:
        $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
        $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
        $question = strip_tags($question);
            $answer = html_entity_decode($answer);
            $answer = nl2br($answer);
        $translatedAnswer = Filter::filterInput(INPUT_POST, 'translated_answer', FILTER_UNSAFE_RAW);
        $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
        $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
        $question = strip_tags($question);

Fixed code:
        $author = trim(Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW));
        $email = trim(Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL));
        $question = trim(strip_tags($question));
            $answer = trim(html_entity_decode($answer));
            $answer = trim(nl2br($answer));
        $translatedAnswer = trim(Filter::filterInput(INPUT_POST, 'translated_answer', FILTER_UNSAFE_RAW));
        $author = trim(Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW));
        $email = trim(Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL));
        $question = trim(strip_tags($question));
CVE-2023-1753 (PHP, published 2023-03-31T01:15Z)
Description: value: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/ajax.user.php
Commit message: fix: removed possible bypass to allow weak passwords


Vulnerable code:

Fixed code:
            } else {
                $userPassword = ''; // set password to empty, so a new one is created
CVE-2023-1755 (PHP, published 2023-03-31T01:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/configuration.php
Commit message: fix: don't update the version number


Vulnerable code:
            $editData['edit']['main.enableWysiwygEditor'] = false; // Disable WYSIWG editor if Markdown is enabled

Fixed code:
            $editData['edit']['main.enableWysiwygEditor'] = false; // Disable WYSIWYG editor if Markdown is enabled
        }
        if (isset($editData['edit']['main.currentVersion'])) {
            unset($editData['edit']['main.currentVersion']); // don't update the version number
CVE-2023-1756 (PHP, published 2023-04-05T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Export/Html5.php
Commit message: fix: added missing CSP for HTML5 exports


Vulnerable code:

Fixed code:
        $this->xml->startElement('meta');
        $this->xml->writeAttribute('http-equiv', 'Content-Security-Policy');
        $this->xml->writeAttribute('content', 'default-src \'self\'; img-src https://*; child-src \'none\';');
        $this->xml->endElement();
CVE-2023-1757 (PHP, published 2023-04-05T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/news.php
phpmyfaq/src/phpMyFAQ/News.php
Commit message: fix: added missing validation of URLs and conversion to HTML entities


Vulnerable code:
                <form id="faqEditor" name="faqEditor" action="?action=save-news" method="post" novalidate>
                            <input class="form-control" type="text" name="link" id="link"
                <form  action="?action=update-news" method="post" accept-charset="utf-8">
                            <input type="text" id="link" name="link"
    $link = Filter::filterInput(INPUT_POST, 'link', FILTER_SANITIZE_SPECIAL_CHARS);
    $linkTitle = Filter::filterInput(INPUT_POST, 'linkTitle', FILTER_SANITIZE_SPECIAL_CHARS);
    $link = Filter::filterInput(INPUT_POST, 'link', FILTER_UNSAFE_RAW);
    $linkTitle = Filter::filterInput(INPUT_POST, 'linkTitle', FILTER_UNSAFE_RAW);
                    $item['linkTitle']

Fixed code:
                <form id="faqEditor" name="faqEditor" action="?action=save-news" method="post" class="needs-validation"
                      novalidate>
                            <input class="form-control" type="url" name="link" id="link"
                <form action="?action=update-news" method="post" accept-charset="utf-8" class="needs-validation"
                      novalidate>
                            <input type="url" id="link" name="link"
    $link = Filter::filterInput(INPUT_POST, 'link', FILTER_VALIDATE_URL);
    $linkTitle = Filter::filterInput(INPUT_POST, 'linkTitle', FILTER_SANITIZE_ENCODED);
    $link = Filter::filterInput(INPUT_POST, 'link', FILTER_VALIDATE_URL);
    $linkTitle = Filter::filterInput(INPUT_POST, 'linkTitle', FILTER_SANITIZE_ENCODED);
                    Strings::htmlentities($item['linkTitle'])
CVE-2023-1758 (PHP, published 2023-04-05T16:15Z)
Description: value: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-75 \u2014 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
The product does not adequately filter user-controlled input for special elements with control implications.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/record.comments.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                        <?= $newsComment->getUsername() ?>
                    <?= $date->format(date('Y-m-d H:i', $faqComment->getDate())) ?> |
                    <a href="<?php printf('../?action=news&id=%d&artlang=%s', $faqComment->getRecordId(), $faqLangCode) ?>">

Fixed code:
                        <?= Strings::htmlentities($newsComment->getUsername()) ?>
                    <?= $date->format(date('Y-m-d H:i', $newsComment->getDate())) ?> |
                    <a href="<?php printf('../?action=news&id=%d&artlang=%s', $newsComment->getRecordId(), $faqLangCode) ?>">
CVE-2023-1760 (PHP, published 2023-03-31T02:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/src/phpMyFAQ/Helper/UserHelper.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                    $this->user->getUserData('display_name'),

Fixed code:
use phpMyFAQ\Strings;
                    Strings::htmlentities($this->user->getUserData('display_name')),
CVE-2023-1761 (PHP, published 2023-03-31T02:15Z)
Description: value: Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/ajaxservice.php
phpmyfaq/src/phpMyFAQ/Comments.php
Commit message: fix: strip tags in comments


Vulnerable code:
                ->setComment(nl2br($comment))
                $item->getUsername()

Fixed code:
                ->setComment(nl2br(strip_tags($comment)))
                Strings::htmlentities($item->getUsername())