wambosec/csi-sqli-rl huggingface dataset:
Security advisory GHSA-v9hf-5j83-6xpp: PyMySQL SQL Injection vulnerability
Package: pymysql (pypi), vulnerable version: 1.1.0, fixed in: 1.1.1
CWE: CWE-89
Files changed by the fix:
pymysql/converters.py

Fix diff:
diff --git a/pymysql/converters.py b/pymysql/converters.py
index 1adac752..dbf97ca7 100644
--- a/pymysql/converters.py
+++ b/pymysql/converters.py
@@ -27,11 +27,7 @@ def escape_item(val, charset, mapping=None):
 
 
 def escape_dict(val, charset, mapping=None):
-    n = {}
-    for k, v in val.items():
-        quoted = escape_item(v, charset, mapping)
-        n[k] = quoted
-    return n
+    raise TypeError("dict can not be used as parameter")
 
 
 def escape_sequence(val, charset, mapping=None):
diff --git a/pymysql/tests/test_connection.py b/pymysql/tests/test_connection.py
index ccfc4a32..dcf3394c 100644
--- a/pymysql/tests/test_connection.py
+++ b/pymysql/tests/test_connection.py
@@ -848,12 +848,15 @@ def test_escape_no_default(self):
 
         self.assertRaises(TypeError, con.escape, 42, {})
 
-    def test_escape_dict_value(self):
+    def test_escape_dict_raise_typeerror(self):
+        """con.escape(dict) should raise TypeError"""
         con = self.connect()
 
         mapping = con.encoders.copy()
         mapping[Foo] = escape_foo
-        self.assertEqual(con.escape({"foo": Foo()}, mapping), {"foo": "bar"})
+        #self.assertEqual(con.escape({"foo": Foo()}, mapping), {"foo": "bar"})
+        with self.assertRaises(TypeError):
+            con.escape({"foo": Foo()})
 
     def test_escape_list_item(self):
         con = self.connect()
Security advisory GHSA-w832-w3p8-cw29: z-push/z-push-dev SQL Injection Vulnerability
Package: z-push/z-push-dev (composer), vulnerable version: 2.7.5, fixed in: 2.7.6
CWE: CWE-89
Files changed by the fix:
src/backend/imap/user_identity.php

Fix diff:
diff --git a/src/backend/imap/user_identity.php b/src/backend/imap/user_identity.php
index 35716566..40c02d93 100644
--- a/src/backend/imap/user_identity.php
+++ b/src/backend/imap/user_identity.php
@@ -208,9 +208,14 @@ function getIdentityFromSql($username, $domain, $identity, $encode = true) {
         $dbh = new PDO(IMAP_FROM_SQL_DSN, IMAP_FROM_SQL_USER, IMAP_FROM_SQL_PASSWORD, unserialize(IMAP_FROM_SQL_OPTIONS));
         ZLog::Write(LOGLEVEL_DEBUG, sprintf("BackendIMAP->getIdentityFromSql() - Connected to SQL Database"));
 
-        $sql = str_replace('#username', $username, str_replace('#domain', $domain, IMAP_FROM_SQL_QUERY));
+        //replace config placeholdes with parameter placeholders
+        $sql = str_replace("'#username'", ":username", str_replace("'#domain'", ":domain", str_replace("'#username@#domain'", ":usernameatdomain", IMAP_FROM_SQL_QUERY)));
+        $usernameatdomain = $username . '@' . $domain;
         ZLog::Write(LOGLEVEL_DEBUG, sprintf("BackendIMAP->getIdentityFromSql() - Searching From with filter: %s", $sql));
         $sth = $dbh->prepare($sql);
+        if(mb_strpos($sql, ':username') !== false) $sth->bindValue(':username', $username, PDO::PARAM_STR);
+        if(mb_strpos($sql, ':domain') !== false) $sth->bindValue(':domain', $domain, PDO::PARAM_STR);
+        if(mb_strpos($sql, ':usernameatdomain') !== false) $sth->bindValue(':usernameatdomain', $usernameatdomain, PDO::PARAM_STR);
         $sth->execute();
         $record = $sth->fetch(PDO::FETCH_ASSOC);
         if ($record) {
Security advisory GHSA-wjjv-3mj2-39hf: AgenticMail API/storage and outbound relay hardening fixes
Package: @agenticmail/api (npm), vulnerable version: 0.9.31, fixed in: 0.9.32
CWE: CWE-20
CWE-284
CWE-319
CWE-798
CWE-89
Files changed by the fix:
packages/api/src/routes/storage.ts

Fix diff:
diff --git a/packages/api/src/routes/storage.ts b/packages/api/src/routes/storage.ts
index 13884bb..324b687 100644
--- a/packages/api/src/routes/storage.ts
+++ b/packages/api/src/routes/storage.ts
@@ -209,9 +209,42 @@ function extractTableRefs(sql: string): string[] {
   const refs = new Set<string>();
   const refPattern = /\b(?:FROM|INTO|UPDATE|TABLE|JOIN)\s+["`[]?([A-Za-z_][A-Za-z0-9_]{0,63})["`\]]?/gi;
   for (const match of sql.matchAll(refPattern)) refs.add(match[1]);
+  // Hardening — the FROM/JOIN-anchored scan above misses tables in a
+  // comma-join list (`FROM agt_mine, agt_victim` only captures the
+  // first). Catch EVERY storage-table-shaped token anywhere in the
+  // query as a backstop: any agt_*/shared_*/metadata token must be
+  // ownership-checked by verifySqlAccess, comma-join or not.
+  const storageTokenPattern = /\b(agt_[A-Za-z0-9_]+|shared_[A-Za-z0-9_]+|agenticmail_storage_meta)\b/gi;
+  for (const match of sql.matchAll(storageTokenPattern)) refs.add(match[1]);
   return [...refs];
 }
 
+/**
+ * Hardening — `having` was the one query clause still interpolated raw
+ * into SQL after the #GHSA storage patch validated `groupBy`/`orderBy`.
+ * HAVING legitimately needs aggregate expressions (`COUNT(*) > 5`), so
+ * it can't be identifier-validated like the others. Instead: bound the
+ * length and reject statement-breaking constructs (stacked statements,
+ * comment markers) and any DDL/DML keyword. The caller already owns the
+ * table and is authenticated, so a HAVING expression that can't escape
+ * the SELECT or run DDL/DML has no meaningful blast radius.
+ */
+function sanitizeHavingClause(having: string): string {
+  if (typeof having !== 'string') {
+    throw new StorageRouteError('having must be a string');
+  }
+  if (having.length > 200) {
+    throw new StorageRouteError('having clause is too long (max 200 chars)');
+  }
+  if (/;|--|\/\*|\*\//.test(having)) {
+    throw new StorageRouteError('having clause contains a forbidden token');
+  }
+  if (/\b(DROP|DELETE|INSERT|UPDATE|UNION|ATTACH|DETACH|PRAGMA|CREATE|ALTER|REPLACE|EXEC|VACUUM)\b/i.test(having)) {
+    throw new StorageRouteError('having clause contains a forbidden keyword');
+  }
+  return having;
+}
+
 function nowExpr(dialect: string): string {
   return dialect === 'postgres' ? 'NOW()' : "datetime('now')";
 }
@@ -900,7 +933,7 @@ export function createStorageRoutes(
       }
 
       if (groupBy) sql += ` GROUP BY ${buildGroupBy(groupBy)}`;
-      if (having) sql += ` HAVING ${having}`;
+      if (having) sql += ` HAVING ${sanitizeHavingClause(having)}`;
       if (orderBy) sql += ` ORDER BY ${buildOrderBy(orderBy)}`;
       if (limit) { sql += ' LIMIT ?'; params.push(limit); }
       if (offset) { sql += ' OFFSET ?'; params.push(offset); }
Security advisory GHSA-x2gw-85w6-fjjw: Cross-site scripting in demos/demo.mysqli.php in getID3
Package: james-heinrich/getid3 (composer), vulnerable version: v1.9.20, fixed in: 1.9.21
CWE: CWE-79
Files changed by the fix:
demos/demo.mysqli.php

Fix diff:
diff --git a/demos/demo.mysqli.php b/demos/demo.mysqli.php
index df451e5b..c0ab530d 100644
--- a/demos/demo.mysqli.php
+++ b/demos/demo.mysqli.php
@@ -1497,7 +1497,7 @@ function SynchronizeAllTags($filename, $synchronizefrom='all', $synchronizeto='A
 		} else {
 
 			echo '<a href="'.htmlentities($_SERVER['PHP_SELF'].'?encoderoptionsdistribution=1').'">Show all Encoder Options</a><hr>';
-			echo 'Files with Encoder Options <b>'.$_REQUEST['showtagfiles'].'</b>:<br>';
+			echo 'Files with Encoder Options <b>'.htmlentities($_REQUEST['showtagfiles']).'</b>:<br>';
 			echo '<table border="1" cellspacing="0" cellpadding="3">';
 			while ($row = mysqli_fetch_array($result)) {
 				echo '<tr>';
Security advisory GHSA-x2jc-pwfj-h9p3: SQL Injection in sequelize
Package: sequelize (npm), vulnerable version: 1.6.0, fixed in: 1.7.0
CWE: CWE-89
Files changed by the fix:
lib/sql-string.js

Fix diff:
diff --git a/lib/sql-string.js b/lib/sql-string.js
index 96be2c7e6ae4..160dfa428d4d 100644
--- a/lib/sql-string.js
+++ b/lib/sql-string.js
@@ -37,8 +37,9 @@ SqlString.escape = function(val, stringifyObjects, timeZone, dialect) {
     }
   }
 
-  if (dialect == "postgres") {
+  if (dialect === "postgres" || dialect === "sqlite") {
     // http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS
+    // http://stackoverflow.com/q/603572/130598
     val = val.replace(/'/g, "''");
   } else {
     val = val.replace(/[\0\n\r\b\t\\\'\"\x1a]/g, function(s) {
Security advisory GHSA-x92h-wmg2-6hp7: Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
Package: symfony/http-foundation (composer), vulnerable version: v2.7.50, fixed in: 2.7.51
CWE: CWE-79
CWE-89
Files changed by the fix:
src/Symfony/Component/HttpFoundation/Request.php

Fix diff:
diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php
index fe1a33a597a3..ae3f51b1724f 100644
--- a/src/Symfony/Component/HttpFoundation/Request.php
+++ b/src/Symfony/Component/HttpFoundation/Request.php
@@ -1346,22 +1346,37 @@ public function setMethod($method)
      */
     public function getMethod()
     {
-        if (null === $this->method) {
-            $this->method = strtoupper($this->server->get('REQUEST_METHOD', 'GET'));
-
-            if ('POST' === $this->method) {
-                if ($method = $this->headers->get('X-HTTP-METHOD-OVERRIDE')) {
-                    $this->method = strtoupper($method);
-                } elseif (self::$httpMethodParameterOverride) {
-                    $method = $this->request->get('_method', $this->query->get('_method', 'POST'));
-                    if (\is_string($method)) {
-                        $this->method = strtoupper($method);
-                    }
-                }
-            }
+        if (null !== $this->method) {
+            return $this->method;
+        }
+
+        $this->method = strtoupper($this->server->get('REQUEST_METHOD', 'GET'));
+
+        if ('POST' !== $this->method) {
+            return $this->method;
+        }
+
+        $method = $this->headers->get('X-HTTP-METHOD-OVERRIDE');
+
+        if (!$method && self::$httpMethodParameterOverride) {
+            $method = $this->request->get('_method', $this->query->get('_method', 'POST'));
+        }
+
+        if (!\is_string($method)) {
+            return $this->method;
+        }
+
+        $method = strtoupper($method);
+
+        if (\in_array($method, ['GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'CONNECT', 'OPTIONS', 'PATCH', 'PURGE', 'TRACE'], true)) {
+            return $this->method = $method;
+        }
+
+        if (!preg_match('/^[A-Z]++$/D', $method)) {
+            throw new SuspiciousOperationException(sprintf('Invalid method override "%s".', $method));
         }
 
-        return $this->method;
+        return $this->method = $method;
     }
 
     /**
Security advisory GHSA-xqg8-cv3h-xppv: SQL Injection in sequelize
Package: sequelize (npm), vulnerable version: 1.7.11, fixed in: 2.0.0-rc8
CWE: CWE-89
Files changed by the fix:
lib/dialects/abstract/query-generator.js

Fix diff:
diff --git a/lib/dialects/abstract/query-generator.js b/lib/dialects/abstract/query-generator.js
index 88e135393147..9ca6526a8daf 100644
--- a/lib/dialects/abstract/query-generator.js
+++ b/lib/dialects/abstract/query-generator.js
@@ -1235,8 +1235,18 @@ module.exports = (function() {
         var mainQueryOrder = [];
         var subQueryOrder = [];
 
+        var validateOrder = function(order) {
+          if (!_.contains(['ASC', 'DESC'], order.toUpperCase())) {
+            throw new Error(util.format('Order must be \'ASC\' or \'DESC\', \'%s\' given', order));
+          }
+        };
+
         if (Array.isArray(options.order)) {
           options.order.forEach(function(t) {
+            if (Array.isArray(t) && _.size(t) > 1) {
+              validateOrder(_.last(t));
+            }
+
             if (subQuery && (Array.isArray(t) && !(t[0] instanceof Model) && !(t[0].model instanceof Model))) {
               subQueryOrder.push(this.quote(t, model));
             }
diff --git a/test/include.test.js b/test/include.test.js
index ac5ceba7a347..75d2a7d76ca6 100644
--- a/test/include.test.js
+++ b/test/include.test.js
@@ -525,7 +525,7 @@ describe(Support.getTestDialectTeaser('Include'), function() {
             ],
             order: [
               User.rawAttributes.id,
-              [Product, 'id']
+              [Product, 'id', 'ASC']
             ]
           }).done(function(err, user) {
             expect(err).not.to.be.ok;