rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder variable to app/edit/folderdelete.php.
Vulnerability ID: CVE-2020-21057
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/fusionpbx/fusionpbx
Published: 2021-05-20
File: app/edit/folder_delete.php
Commit message: Update and rename folderdelete.php to folder_delete.php
Commit author: FusionPBX

Vulnerable version (before fix):
 	Mark J Crane <markjcrane@fusionpbx.com> */  //includes 	include "root.php"; 	require_once "resources/require.php";  		//delete the folder 		rmdir($folder); //, 0700 		header("Location: fileoptions.php"); 	} 	else { 		//create the token

Fixed version (after fix):
 	Mark J Crane <markjcrane@fusionpbx.com> */  //disable this feature 	exit;  //includes 	include "root.php"; 	require_once "resources/require.php";  		//delete the folder 		rmdir($folder); //, 0700 		header("Location: file_options.php"); 	} 	else { 		//create the token

Patch:
patch: @@ -24,6 +24,9 @@
 	Mark J Crane <markjcrane@fusionpbx.com>
 */
 
+//disable this feature
+	exit;
+
 //includes
 	include "root.php";
 	require_once "resources/require.php";
@@ -54,7 +57,7 @@
 
 		//delete the folder
 		rmdir($folder); //, 0700
-		header("Location: fileoptions.php");
+		header("Location: file_options.php");
 	}
 	else {
 		//create the token
path: app/edit/folder_delete.php
Vulnerability: Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php.
Vulnerability ID: CVE-2020-22607
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/LimeSurvey/LimeSurvey
Published: 2021-06-28
File: application/controllers/admin/PermissiontemplatesController.php
Commit message: Fixed issue [security] #16068: Stored Cross Site Scripting Vulnerability in permission rules. (Thanks to Matthew Aberegg)
Commit author: Patrick Teichmann

Vulnerable version (before fix):
 public function applyedit()         $aPermissiontemplate = Yii::app()->request->getPost('Permissiontemplates');         $model = $this->loadModel($aPermissiontemplate['ptid']);          $newAttributes = array_merge($model->attributes, $aPermissiontemplate);         $model->attributes = $newAttributes; 

Fixed version (after fix):
 public function applyedit()         $aPermissiontemplate = Yii::app()->request->getPost('Permissiontemplates');         $model = $this->loadModel($aPermissiontemplate['ptid']);          // XSS filter         $aPermissiontemplate['name'] = CHtml::encode($aPermissiontemplate['name']);         $aPermissiontemplate['description'] = CHtml::encode($aPermissiontemplate['description']);          $newAttributes = array_merge($model->attributes, $aPermissiontemplate);         $model->attributes = $newAttributes; 

Patch:
patch: @@ -83,6 +83,10 @@ public function applyedit()
         $aPermissiontemplate = Yii::app()->request->getPost('Permissiontemplates');
         $model = $this->loadModel($aPermissiontemplate['ptid']);
 
+        // XSS filter
+        $aPermissiontemplate['name'] = CHtml::encode($aPermissiontemplate['name']);
+        $aPermissiontemplate['description'] = CHtml::encode($aPermissiontemplate['description']);
+
         $newAttributes = array_merge($model->attributes, $aPermissiontemplate);
         $model->attributes = $newAttributes;
path: application/controllers/admin/PermissiontemplatesController.php
Vulnerability: Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php.
Vulnerability ID: CVE-2020-22608
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/osTicket/osTicket
Published: 2021-06-28
File: include/ajax.search.php
Commit message: xss: Saved Search Name

This mitigates an issue discovered by Matthew Aberegg where the Name field
for Saved Searches can be exploited via XSS to execute code. This sanitizes
the `$_POST['queue-name']` variable via `Format::htmlchars()` so we are
safe from any XSS attempts on creations and updates. All other Saved Search
content is parsed/sanitized correctly.
Commit author: JediKev

Vulnerable version (before fix):
 function saveSearch($id=0) {     }      function _saveSearch(SavedSearch $search) {          // Validate the form.         $form = $search->getForm($_POST);

Fixed version (after fix):
 function saveSearch($id=0) {     }      function _saveSearch(SavedSearch $search) {         $_POST['queue-name'] = Format::htmlchars($_POST['queue-name']);          // Validate the form.         $form = $search->getForm($_POST);

Patch:
patch: @@ -202,6 +202,7 @@ function saveSearch($id=0) {
     }
 
     function _saveSearch(SavedSearch $search) {
+        $_POST['queue-name'] = Format::htmlchars($_POST['queue-name']);
 
         // Validate the form.
         $form = $search->getForm($_POST);
path: include/ajax.search.php
Vulnerability: Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext.
Vulnerability ID: CVE-2020-22617
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/Ardour/ardour
Published: 2021-10-08
File: libs/pbd/xml++.cc
Commit message: fix apparent free-ordering issue reported in #7926
Commit author: Paul Davis

Vulnerable version (before fix):
 static XMLSharedNodeList* find_impl(xmlXPathContext* ctxt, const string& xpath) 	xmlXPathObject* result = xmlXPathEval((const xmlChar*)xpath.c_str(), ctxt);  	if (!result) { 		xmlXPathFreeContext(ctxt); 		xmlFreeDoc(ctxt->doc);  		throw XMLException("Invalid XPath: " + xpath); 	}  	if (result->type != XPATH_NODESET) { 		xmlXPathFreeObject(result); 		xmlXPathFreeContext(ctxt); 		xmlFreeDoc(ctxt->doc);  		throw XMLException("Only nodeset result types are supported."); 	}

Fixed version (after fix):
 static XMLSharedNodeList* find_impl(xmlXPathContext* ctxt, const string& xpath) 	xmlXPathObject* result = xmlXPathEval((const xmlChar*)xpath.c_str(), ctxt);  	if (!result) { 		xmlFreeDoc(ctxt->doc); 		xmlXPathFreeContext(ctxt);  		throw XMLException("Invalid XPath: " + xpath); 	}  	if (result->type != XPATH_NODESET) { 		xmlXPathFreeObject(result); 		xmlFreeDoc(ctxt->doc); 		xmlXPathFreeContext(ctxt);  		throw XMLException("Only nodeset result types are supported."); 	}

Patch:
patch: @@ -770,16 +770,16 @@ static XMLSharedNodeList* find_impl(xmlXPathContext* ctxt, const string& xpath)
 	xmlXPathObject* result = xmlXPathEval((const xmlChar*)xpath.c_str(), ctxt);
 
 	if (!result) {
-		xmlXPathFreeContext(ctxt);
 		xmlFreeDoc(ctxt->doc);
+		xmlXPathFreeContext(ctxt);
 
 		throw XMLException("Invalid XPath: " + xpath);
 	}
 
 	if (result->type != XPATH_NODESET) {
 		xmlXPathFreeObject(result);
-		xmlXPathFreeContext(ctxt);
 		xmlFreeDoc(ctxt->doc);
+		xmlXPathFreeContext(ctxt);
 
 		throw XMLException("Only nodeset result types are supported.");
 	}
path: libs/pbd/xml++.cc
Vulnerability: APfell 1.4 is vulnerable to authenticated reflected cross-site scripting (XSS) in /apiui/command_ through the payloadtypes_callback function, which allows an attacker to steal remote admin/user session and/or adding new users to the administration panel.
Vulnerability ID: CVE-2020-23014
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/its-a-feature/Apfell
Published: 2021-01-26
File: apfell-docker/app/routes/api_routes.py
Commit message: fixed an 'Authenticated Cross-Site Scripting' bug on the command help page reported by 'Mohamed A. Baset' of 'Seekurity SA de C.V.' at 'Seekurity.com' on April 17,2020
Commit author: Cody Thomas

Vulnerable version (before fix):
 from app import apfell, links, use_ssl from sanic import response from jinja2 import Environment, PackageLoader from sanic_jwt.decorators import scoped, inject_user from app.routes.routes import respect_pivot import urllib.parse  env = Environment(loader=PackageLoader('app', 'templates'))  async def apiui_command_help(request, user):     template = env.get_template('apiui_command_help.html')     if len(request.query_args) != 0:         data = urllib.parse.unquote(request.query_args[0][1])         print(data)     else:         data = ""     if use_ssl:

Fixed version (after fix):
 from app import apfell, links, use_ssl, db_objects from sanic import response from jinja2 import Environment, PackageLoader from sanic_jwt.decorators import scoped, inject_user from app.routes.routes import respect_pivot import urllib.parse import app.database_models.model as db_model  env = Environment(loader=PackageLoader('app', 'templates'))  async def apiui_command_help(request, user):     template = env.get_template('apiui_command_help.html')     if len(request.query_args) != 0:         data = urllib.parse.unquote(request.query_args[0][1])         query = await db_model.payloadtype_query()         try:             payloadtype = await db_objects.get(query, ptype=data)         except Exception as e:             data = ""     else:         data = ""     if use_ssl:

Patch:
patch: @@ -1,9 +1,10 @@
-from app import apfell, links, use_ssl
+from app import apfell, links, use_ssl, db_objects
 from sanic import response
 from jinja2 import Environment, PackageLoader
 from sanic_jwt.decorators import scoped, inject_user
 from app.routes.routes import respect_pivot
 import urllib.parse
+import app.database_models.model as db_model
 
 env = Environment(loader=PackageLoader('app', 'templates'))
 
@@ -15,7 +16,11 @@ async def apiui_command_help(request, user):
     template = env.get_template('apiui_command_help.html')
     if len(request.query_args) != 0:
         data = urllib.parse.unquote(request.query_args[0][1])
-        print(data)
+        query = await db_model.payloadtype_query()
+        try:
+            payloadtype = await db_objects.get(query, ptype=data)
+        except Exception as e:
+            data = ""
     else:
         data = ""
     if use_ssl:
path: apfell-docker/app/routes/api_routes.py
Vulnerability: An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible out of bounds read due to a heap buffer overflow. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution.
Vulnerability ID: CVE-2020-23907
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/avast/retdec
Published: 2021-04-21
File: src/bin2llvmir/optimizations/decoder/ir_modifications.cpp
Commit message: Try to fix issue #637

Reference: https://github.com/avast/retdec/issues/637
Commit author: azhou

Vulnerable version (before fix):
 bool Decoder::canSplitFunctionOn( 				continue; 			} 			auto up = fncStarts.upper_bound(bAddr); 			--up; 			Address bFnc = *up;  bool Decoder::canSplitFunctionOn( 					continue; 				} 				auto up = fncStarts.upper_bound(pAddr); 				--up; 				Address pFnc = *up; 

Fixed version (after fix):
 bool Decoder::canSplitFunctionOn( 				continue; 			} 			auto up = fncStarts.upper_bound(bAddr); 			if (up == fncStarts.begin()) { 				return false; 			}	 			--up; 			Address bFnc = *up;  bool Decoder::canSplitFunctionOn( 					continue; 				} 				auto up = fncStarts.upper_bound(pAddr); 				if (up == fncStarts.begin()) { 					return false; 				} 				--up; 				Address pFnc = *up; 

Patch:
patch: @@ -423,6 +423,9 @@ bool Decoder::canSplitFunctionOn(
 				continue;
 			}
 			auto up = fncStarts.upper_bound(bAddr);
+			if (up == fncStarts.begin()) {
+				return false;
+			}	
 			--up;
 			Address bFnc = *up;
 
@@ -442,6 +445,9 @@ bool Decoder::canSplitFunctionOn(
 					continue;
 				}
 				auto up = fncStarts.upper_bound(pAddr);
+				if (up == fncStarts.begin()) {
+					return false;
+				}
 				--up;
 				Address pFnc = *up;
path: src/bin2llvmir/optimizations/decoder/ir_modifications.cpp
Vulnerability: An issue was discovered in gpac before 1.0.1. The abst_box_read function in box_code_adobe.c has a heap-based buffer over-read.
Vulnerability ID: CVE-2020-23928
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/gpac/gpac
Published: 2021-04-21
File: src/isomedia/box_code_adobe.c
Commit message: fixed #1568
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)  	i=0; 	if (ptr->size<8) return GF_ISOM_INVALID_FILE; 	tmp_strsize =(u32)ptr->size-8; 	tmp_str = gf_malloc(sizeof(char)*tmp_strsize); 	if (!tmp_str) return GF_OUT_OF_MEM; 	memset(tmp_str, 0, sizeof(char)*tmp_strsize);

Fixed version (after fix):
 GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)  	i=0; 	if (ptr->size<8) return GF_ISOM_INVALID_FILE; 	tmp_strsize =(u32)ptr->size; 	tmp_str = gf_malloc(sizeof(char)*tmp_strsize); 	if (!tmp_str) return GF_OUT_OF_MEM; 	memset(tmp_str, 0, sizeof(char)*tmp_strsize);

Patch:
patch: @@ -93,7 +93,7 @@ GF_Err abst_box_read(GF_Box *s, GF_BitStream *bs)
 
 	i=0;
 	if (ptr->size<8) return GF_ISOM_INVALID_FILE;
-	tmp_strsize =(u32)ptr->size-8;
+	tmp_strsize =(u32)ptr->size;
 	tmp_str = gf_malloc(sizeof(char)*tmp_strsize);
 	if (!tmp_str) return GF_OUT_OF_MEM;
 	memset(tmp_str, 0, sizeof(char)*tmp_strsize);
path: src/isomedia/box_code_adobe.c
Vulnerability: An issue was discovered in gpac before 1.0.1. A NULL pointer dereference exists in the function dump_isom_sdp located in filedump.c. It allows an attacker to cause Denial of Service.
Vulnerability ID: CVE-2020-23932
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-04-21
File: applications/mp4box/filedump.c
Commit message: fixed #1566
Commit author: jeanlf

Vulnerable version (before fix):
 void dump_isom_sdp(GF_ISOFile *file, char *inName, Bool is_final_name) 	} 	//get the movie SDP 	gf_isom_sdp_get(file, &sdp, &size); 	fprintf(dump, "%s", sdp); 	fprintf(dump, "\r\n");  	//then tracks

Fixed version (after fix):
 void dump_isom_sdp(GF_ISOFile *file, char *inName, Bool is_final_name) 	} 	//get the movie SDP 	gf_isom_sdp_get(file, &sdp, &size); 	if (sdp && size) 		fprintf(dump, "%s", sdp); 	fprintf(dump, "\r\n");  	//then tracks

Patch:
patch: @@ -1624,7 +1624,8 @@ void dump_isom_sdp(GF_ISOFile *file, char *inName, Bool is_final_name)
 	}
 	//get the movie SDP
 	gf_isom_sdp_get(file, &sdp, &size);
-	fprintf(dump, "%s", sdp);
+	if (sdp && size)
+		fprintf(dump, "%s", sdp);
 	fprintf(dump, "\r\n");
 
 	//then tracks
path: applications/mp4box/filedump.c
Vulnerability: Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row.
Vulnerability ID: CVE-2020-24342
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/lua/lua
Published: 2020-08-13
File: ldo.c
Commit message: Fixed bug: 'luaD_callnoyield' called twice in a row

In luaD_callnoyield, when there is a possible stack overflow, it
zeros the number of CallInfos to force a check when calling the
function. However, if the "function" is not a function, the code will
raise an error before checking the stack. Then, the error handling calls
luaD_callnoyield again and nCcalls is decremented again, crossing the
stack redzone without raising an error. (This loop can only happens
once, because the error handler must be a function.  But once is enough
to cross the redzone.)
Commit author: Roberto Ierusalimschy

Vulnerable version (before fix):
 void luaD_call (lua_State *L, StkId func, int nresults) {  /* ** Similar to 'luaD_call', but does not allow yields during the call. ** If there is a stack overflow, freeing all CI structures will ** force the subsequent call to invoke 'luaE_extendCI', which then ** will raise any errors. */ void luaD_callnoyield (lua_State *L, StkId func, int nResults) {   incXCcalls(L);   if (getCcalls(L) <= CSTACKERR)  /* possible stack overflow? */     luaE_freeCI(L);   luaD_call(L, func, nResults);   decXCcalls(L); }

Fixed version (after fix):
 void luaD_call (lua_State *L, StkId func, int nresults) {  /* ** Similar to 'luaD_call', but does not allow yields during the call. */ void luaD_callnoyield (lua_State *L, StkId func, int nResults) {   incXCcalls(L);   if (getCcalls(L) <= CSTACKERR) {  /* possible C stack overflow? */     luaE_exitCcall(L);  /* to compensate decrement in next call */     luaE_enterCcall(L);  /* check properly */   }   luaD_call(L, func, nResults);   decXCcalls(L); }

Patch:
patch: @@ -515,14 +515,13 @@ void luaD_call (lua_State *L, StkId func, int nresults) {
 
 /*
 ** Similar to 'luaD_call', but does not allow yields during the call.
-** If there is a stack overflow, freeing all CI structures will
-** force the subsequent call to invoke 'luaE_extendCI', which then
-** will raise any errors.
 */
 void luaD_callnoyield (lua_State *L, StkId func, int nResults) {
   incXCcalls(L);
-  if (getCcalls(L) <= CSTACKERR)  /* possible stack overflow? */
-    luaE_freeCI(L);
+  if (getCcalls(L) <= CSTACKERR) {  /* possible C stack overflow? */
+    luaE_exitCcall(L);  /* to compensate decrement in next call */
+    luaE_enterCcall(L);  /* check properly */
+  }
   luaD_call(L, func, nResults);
   decXCcalls(L);
 }
path: ldo.c
Vulnerability: eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording.
Vulnerability ID: CVE-2020-24390
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/EyesOfNetworkCommunity/eonweb
Published: 2020-08-27
File: include/function.php
Commit message: FIX 2.4 protect login/logout logs recording
Commit author: root

Vulnerable version (before fix):
 function stripAccents($str, $charset='utf-8'){ function logging($module,$command,$user=false){ 	global $database_eonweb; 	global $dateformat; 	if($user) 		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','$user','$module','$command','".$_SERVER["REMOTE_ADDR"]."');"); 	elseif(isset($_COOKIE['user_name'])) 		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$_COOKIE['user_name']."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');"); }  // Time

Fixed version (after fix):
 function stripAccents($str, $charset='utf-8'){ function logging($module,$command,$user=false){ 	global $database_eonweb; 	global $dateformat; 	if($user){ 		$user = htmlspecialchars($user); 		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','$user','$module','$command','".$_SERVER["REMOTE_ADDR"]."');"); 	}elseif(isset($_COOKIE['user_name'])){ 		$user = htmlspecialchars($_COOKIE['user_name']); 		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$user."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');"); 	} }  // Time

Patch:
patch: @@ -370,10 +370,13 @@ function stripAccents($str, $charset='utf-8'){
 function logging($module,$command,$user=false){
 	global $database_eonweb;
 	global $dateformat;
-	if($user)
+	if($user){
+		$user = htmlspecialchars($user);
 		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','$user','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");
-	elseif(isset($_COOKIE['user_name']))
-		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$_COOKIE['user_name']."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");
+	}elseif(isset($_COOKIE['user_name'])){
+		$user = htmlspecialchars($_COOKIE['user_name']);
+		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$user."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");
+	}
 }
 
 // Time
path: include/function.php
Vulnerability: A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation (CBOR) input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings leads to the use of an attacker-controllable uninitialized stack value. This can be used to modify memory, causing a crash or potentially exploitable heap corruption.
Vulnerability ID: CVE-2020-24753
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/objsys/oocborrt
Published: 2020-09-17
File: util/cbor2json.c
Commit message: fixed missing return status test error
Commit author: objsys

Vulnerable version (before fix):
 static int cbor2json (OSCTXT* pCborCtxt, OSCTXT* pJsonCtxt)    case OSRTCBOR_UTF8STR: {       OSUTF8CHAR* utf8str;       ret = rtCborDecDynUTF8Str (pCborCtxt, ub, (char**)&utf8str);        ret = rtJsonEncStringValue (pJsonCtxt, utf8str);       rtxMemFreePtr (pCborCtxt, utf8str);

Fixed version (after fix):
 static int cbor2json (OSCTXT* pCborCtxt, OSCTXT* pJsonCtxt)    case OSRTCBOR_UTF8STR: {       OSUTF8CHAR* utf8str;       ret = rtCborDecDynUTF8Str (pCborCtxt, ub, (char**)&utf8str);       if (0 != ret) return LOG_RTERR (pCborCtxt, ret);        ret = rtJsonEncStringValue (pJsonCtxt, utf8str);       rtxMemFreePtr (pCborCtxt, utf8str);

Patch:
patch: @@ -112,6 +112,7 @@ static int cbor2json (OSCTXT* pCborCtxt, OSCTXT* pJsonCtxt)
    case OSRTCBOR_UTF8STR: {
       OSUTF8CHAR* utf8str;
       ret = rtCborDecDynUTF8Str (pCborCtxt, ub, (char**)&utf8str);
+      if (0 != ret) return LOG_RTERR (pCborCtxt, ret);
 
       ret = rtJsonEncStringValue (pJsonCtxt, utf8str);
       rtxMemFreePtr (pCborCtxt, utf8str);
path: util/cbor2json.c
Vulnerability: An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.
Vulnerability ID: CVE-2020-25288
CWE: CWE-79
Severity score: 2.9
Project: http://github.com/mantisbt/mantisbt
Published: 2020-09-30
File: core/cfdefs/cfdef_standard.php
Commit message: Fix XSS in Custom Field regex pattern validation

Improper escaping of the custom field definition's Regular Expression
allowed an attacker to inject HTML into the page (CVE-2020-25288).

Credits to d3vpoo1 (https://gitlab.com/jrckmcsb) for the finding.

Fixes #27275
Commit author: Damien Regad

Vulnerable version (before fix):
 function cfdef_input_textbox( array $p_field_def, $p_custom_field_value, $p_requ 		if( substr( $t_cf_regex, -1 ) != '$' ) { 			$t_cf_regex .= '.*'; 		} 		echo ' pattern="' . $t_cf_regex . '"'; 	} 	echo ' value="' . string_attribute( $p_custom_field_value ) .'" />'; }

Fixed version (after fix):
 function cfdef_input_textbox( array $p_field_def, $p_custom_field_value, $p_requ 		if( substr( $t_cf_regex, -1 ) != '$' ) { 			$t_cf_regex .= '.*'; 		} 		echo ' pattern="' . string_attribute( $t_cf_regex ) . '"'; 	} 	echo ' value="' . string_attribute( $p_custom_field_value ) .'" />'; }

Patch:
patch: @@ -467,7 +467,7 @@ function cfdef_input_textbox( array $p_field_def, $p_custom_field_value, $p_requ
 		if( substr( $t_cf_regex, -1 ) != '$' ) {
 			$t_cf_regex .= '.*';
 		}
-		echo ' pattern="' . $t_cf_regex . '"';
+		echo ' pattern="' . string_attribute( $t_cf_regex ) . '"';
 	}
 	echo ' value="' . string_attribute( $p_custom_field_value ) .'" />';
 }
path: core/cfdefs/cfdef_standard.php