hitoshura25/cvefixes huggingface dataset:
CVE-2022-0777 (PHP, published 2022-03-01T09:15Z)
Description: value: Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/microweber/microweber
Files changed:
config/auth.php
src/MicroweberPackages/User/routes/api.php
src/MicroweberPackages/User/routes/web.php
Commit message: forgot password add throttle


Vulnerable code:
    Route::post('/forgot-password', 'UserForgotPasswordController@send')->name('password.email');
    Route::post('/forgot-password', 'UserForgotPasswordController@send')->name('password.email');

Fixed code:
            'throttle' => 60,
    Route::post('/forgot-password', 'UserForgotPasswordController@send')
        ->middleware(['throttle:3,1'])
        ->name('password.email');
    Route::post('/forgot-password', 'UserForgotPasswordController@send')
        ->middleware(['throttle:3,1'])
        ->name('password.email');
CVE-2022-0895 (PHP, published 2022-03-10T11:15Z)
Description: value: Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Checkout/Http/Controllers/Traits/ContactInformationTrait.php
Commit message: Update ContactInformationTrait.php


Vulnerable code:
            'first_name'=> $request->get('first_name'),
            'last_name'=> $request->get('last_name'),
            'email'=> $request->get('email'),
            'phone'=> $request->get('phone')

Fixed code:
        $firstName = strip_tags($request->get('first_name'));
        $lastName = strip_tags($request->get('last_name'));
        $email = strip_tags($request->get('email'));
        $phone = strip_tags($request->get('phone'));

            'first_name'=> $firstName,
            'last_name'=> $lastName,
            'email'=> $email,
            'phone'=> $phone
CVE-2022-0896 (PHP, published 2022-03-09T12:15Z)
Description: value: Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Comment/Http/Controllers/Admin/AdminCommentController.php
Commit message: Update AdminCommentController.php


Vulnerable code:




        // Claer HTML
        $comment_body = $this->app->format->clean_html($comment_body);

        // Clear XSS
        $evil = ['(?<!\w)on\w*', 'xmlns', 'formaction', 'xlink:href', 'FSCommand', 'seekSegmentTime'];
        $comment_body = $this->app->format->clean_xss($comment_body, true, $evil, 'removeEvilAttributes');

Fixed code:
use MicroweberPackages\Helper\HTMLClean;
        $cleanHtml = new HTMLClean();
        $comment_body = $cleanHtml->onlyTags($comment_body);
CVE-2022-0906 (PHP, published 2022-03-10T15:15Z)
Description: value: Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Utils/System/Files.php
Commit message: update


Vulnerable code:

Fixed code:
            'aspx',
CVE-2022-0912 (PHP, published 2022-03-11T10:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/functions/plupload.php
src/MicroweberPackages/Utils/System/Files.php
src/MicroweberPackages/Utils/Zip/Unzip.php
Commit message: update


Vulnerable code:

                                return false;

Fixed code:
                                case 'phtml':
                                case 'php6':
            'phtml',
            'php6',
CVE-2022-0913 (PHP, published 2022-03-11T10:15Z)
Description: value: Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Checkout/Http/Controllers/Traits/ShippingTrait.php
Commit message: checkout shipping address validation - max chars allowed


Vulnerable code:
               'city'=>$request->get('Address')['city'],
               'zip'=>$request->get('Address')['zip'],
               'state'=>$request->get('Address')['state'],
               'address'=>$request->get('Address')['address'],

Fixed code:
                'city'=>$request->get('Address')['city'],
                'zip'=>$request->get('Address')['zip'],
                'state'=>$request->get('Address')['state'],
                'address'=>$request->get('Address')['address'],
        $rules = [];
        $rules['shipping_gw'] = 'max:500';
        $rules['city'] = 'max:500';
        $rules['address'] = 'max:500';
        $rules['country'] = 'max:500';
        $rules['state'] = 'max:500';
        $rules['zip'] = 'max:500';
        $rules['other_info'] = 'max:500';

        $validator = Validator::make($request->all(), $rules);

        if ($validator->fails()) {
            $errors = $validator->messages()->toArray();
            session_set('errors', $errors);
            return redirect(route('checkout.shipping_method'));
        }
CVE-2022-0928 (PHP, published 2022-03-11T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/functions/api_callbacks.php
src/MicroweberPackages/Tax/TaxManager.php
src/MicroweberPackages/Tax/TaxManagerServiceProvider.php
src/MicroweberPackages/Tax/routes/api.php
src/MicroweberPackages/Tax/routes/web.php
Commit message: upgrade taxes to laravel routers


Vulnerable code:
api_expose_admin('shop/save_tax_item', function ($data) {
    return mw()->tax_manager->save($data);
});
api_expose_admin('shop/delete_tax_item', function ($data) {
    return mw()->tax_manager->delete_by_id($data);
});

Fixed code:
use Illuminate\Support\Facades\Validator;
use MicroweberPackages\Helper\HTMLClean;

        $rules = [];
        $rules['name'] = 'required|max:500';
        $rules['type'] = 'required|max:500';
        $rules['rate'] = 'required|max:500';

        $validator = Validator::make($params, $rules);

        if ($validator->fails()) {
            $errors = $validator->messages()->toArray();
            return ['valid'=>false,'errors'=>$errors];
        }


    public function register()
    {
        $this->loadRoutesFrom((__DIR__) . '/routes/api.php');
        $this->loadRoutesFrom((__DIR__) . '/routes/web.php');
    }
<?php

use Illuminate\Support\Facades\Route;

\Route::name('api.')

    ->prefix('api')
    ->middleware(['api', 'admin', 'xss'])
    ->namespace('\MicroweberPackages\Tax\Http\Controllers\Api')
    ->group(function () {

        Route::any('shop/save_tax_item', function () {
            $data = request()->all();
            return mw()->tax_manager->save($data);
        });

        Route::any('shop/delete_tax_item', function () {
            $data = request()->all();
            return mw()->tax_manager->delete_by_id($data);
        });

    });
<?php
CVE-2022-0929 (YAML, published 2022-03-12T11:15Z)
Description: value: XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
.github/workflows/build-and-upload.yml
Commit message: Update build-and-upload.yml


Vulnerable code:
    needs: stop-previous-runs

Fixed code:
CVE-2022-0930 (PHP, published 2022-03-12T14:15Z)
Description: value: File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/functions/plupload.php
src/MicroweberPackages/Utils/System/Files.php
Commit message: make plupload only allowed files


Vulnerable code:
$is_dangerous_file = $files_utils->is_dangerous_file($fileName_ext);
if ($is_dangerous_file) {
            'vbhtml', 
                $are_allowed .= ',png,gif,jpg,jpeg,tiff,bmp,svg';
                $are_allowed .= ',avi,asf,mpg,mpeg,mp4,flv,mkv,webm,ogg,wma,mov,wmv';

Fixed code:
$is_allowed_file = $files_utils->is_allowed_file($fileName_ext);
if ($is_allowed_file == false) {
            'vbhtml',
    public function is_allowed_file($fileName)
    {
        $allowedImages = $this->get_allowed_files_extensions_for_upload('images');
        $allowedVideos = $this->get_allowed_files_extensions_for_upload('videos');
        $allowedAudios = $this->get_allowed_files_extensions_for_upload('audios');
        $allowedFiles = $this->get_allowed_files_extensions_for_upload('files');
        $allowedDocuments = $this->get_allowed_files_extensions_for_upload('documents');
        $allowedArchives = $this->get_allowed_files_extensions_for_upload('archives');

        $allowed = array_merge_recursive($allowedImages,$allowedVideos,$allowedAudios,$allowedFiles,$allowedDocuments,$allowedArchives);

        $isExt = get_file_extension($fileName);
        $isExt = strtolower($isExt);

        if (in_array($isExt, $allowed)) {
            return true;
        }

        return false;
    }


                $are_allowed .= ',png,gif,jpg,jpeg,tiff,bmp,svg,webp,ico';
                break;
            case 'audio':
            case 'audios':
                $are_allowed .= ',mp3,mp4,ogg,wav,flac';
                $are_allowed .= ',avi,asf,mpg,mpeg,mp4,flv,mkv,webm,ogg,ogv,3gp,3g2,wma,mov,wmv';
CVE-2022-0954 (PHP, published 2022-03-15T12:15Z)
Description: value: Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Option/Http/Controllers/Api/SaveOptionApiController.php
Commit message: Update SaveOptionApiController.php


Vulnerable code:
    public function saveOption(Request $request) {
        // Allow for this keys
            if ($option['option_key'] == 'website_head') {
                $cleanFromXss = false;
            }
            if ($option['option_key'] == 'website_footer') {
                $cleanFromXss = false;

Fixed code:
    public $whitelistedGroupKeys = [
        'website' => [
            'website_head',
            'website_footer'
        ]
    ];

    public function saveOption(Request $request)
    {
        // Allow for this keys and groups
            foreach ($this->whitelistedGroupKeys as $group => $keys) {
                if ($option['option_group'] == $group) {
                    foreach ($keys as $key) {
                        if ($option['option_key'] == $key) {
                            $cleanFromXss = false;
                            break;
                        }
                    }
                }
CVE-2022-0961 (PHP, published 2022-03-15T15:15Z)
Description: value: The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Post/Http/Requests/PostRequest.php
Commit message: Update PostRequest.php


Vulnerable code:
           // 'title' => 'required', // todo with multilanguage

Fixed code:
        // todo with multilanguage

            'title' => 'required|max:500',
            'url' => 'max:500',
            'description' => 'max:500',
            'content_meta_title' => 'max:500',
            'content_meta_keywords' => 'max:500',
            'original_link' => 'max:500',
CVE-2022-0963 (PHP, published 2022-03-15T16:15Z)
Description: value: Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Utils/System/Files.php
Commit message: Update Files.php


Vulnerable code:
                $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,xml,psd,xlsx,csv,7z';
                $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xml,xlr,xls,xlsx';

Fixed code:
                $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,psd,xlsx,csv,7z'; 
                $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xlr,xls,xlsx';
CVE-2022-0968 (PHP, published 2022-03-15T16:15Z)
Description: value: The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php
src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
Commit message: user update requrest validation


Vulnerable code:
             'username' => 'required|unique:users,username',
             'email' => 'unique:users,email',


Fixed code:
             'first_name'=>'max:500',
             'last_name'=>'max:500',
             'phone'=>'max:500',
             'username' => 'required|unique:users,username|max:500',
             'email' => 'unique:users,email|max:500',
            'first_name'=>'max:500',
            'last_name'=>'max:500',
            'phone'=>'max:500',
                'max:500'
                'max:500'
CVE-2022-1036 (PHP, published 2022-03-22T13:15Z)
Description: value: Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweber/microweber prior to 1.2.12.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/User/Http/Controllers/UserForgotPasswordController.php
src/MicroweberPackages/User/Http/Requests/RegisterRequest.php
src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php
src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
Commit message: max 500 chars on password


Vulnerable code:
            'password' => 'required|min:1|confirmed',
        $rules['password'] = 'required|min:1';

Fixed code:
            'password' => 'required|min:1|confirmed|max:500',
        $rules['password'] = 'required|min:1|max:500';
             'password'=>'max:500',
            'password'=>'max:500',
CVE-2022-1439 (PHP, published 2022-04-22T17:15Z)
Description: value: Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/Http/Controllers/ApiController.php
Commit message: update


Vulnerable code:

Fixed code:
                if(is_string($v)) {
                    $v = str_replace('<', '-', $v);
                    $v = str_replace('>', '-', $v);
                }
                    $k = str_replace('<', '-', $k);
                    $k = str_replace('>', '-', $k);
CVE-2022-1555 (PHP, published 2022-05-04T09:15Z)
Description: value: DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Order/resources/views/admin/orders/partials/order_filtering.blade.php
Commit message: Update order_filtering.blade.php


Vulnerable code:
                    placeholder: "<?php if ($productKeyword) { echo $productKeyword; } else { _e("Search by products..."); }?>",

Fixed code:
                    placeholder: "<?php if ($productKeyword) { echo xss_clean($productKeyword); } else { _e("Search by products..."); }?>",
CVE-2022-1584 (PHP, published 2022-05-04T18:15Z)
Description: value: Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/Http/Controllers/ApiController.php
src/MicroweberPackages/Helper/XSSClean.php
Commit message: update


Vulnerable code:

Fixed code:
                    $v = str_replace('"', '-', $v);
                    $v = str_replace("'", '-', $v);
                    $k = str_replace('"', '-', $k);
                    $k = str_replace("'", '-', $k);
            'ondragexit',