Credit + review request: CVE-2026-108100 (GHSA-cwp7-9356-rvxx) & CVE-2026-108101 (GHSA-m2c2-px87-9hp9) — reporter @hackchang per published source advisories #10742

Hello GitHub Security (Advisory Database) team,

Two advisories for danielbrendel/hortusfox-web are currently in the GitHub Advisory Database as unreviewed auto-imports (ingested from VulnCheck) with no credits, even though the corresponding published GitHub repository Security Advisories credit me (@hackchang) as the reporter (credit accepted). Both unreviewed entries already reference those source advisories. I'd like to request that these be reviewed and that the reporter credit be reflected in the global database so it is attributable (e.g. via a credit:hackchang search / researcher profile).

1. CVE-2026-108100

• Unreviewed global advisory: GHSA-cwp7-9356-rvxx
• Source repo advisory (published, Credits = @hackchang, reporter accepted): GHSA-4w8p-x2jj-42w7
• SQL injection via the include_info parameter of /api/locations/list (reachable before the fix). Affected: hortusfox < 6.2; fixed in 6.2.

2. CVE-2026-108101

• Unreviewed global advisory: GHSA-m2c2-px87-9hp9
• Source repo advisory (published, Credits = @hackchang, reporter accepted): GHSA-8phf-v3xj-8jjg
• Unrestricted file upload to the webroot in PlantAttachmentModel (no extension allowlist) → PHP webshell upload → RCE. Affected: hortusfox through 6.3.

Both source repository advisories were published by the maintainer (@danielbrendel) and list @hackchang in Credits (reporter, accepted ~25 days ago). The unreviewed database entries already link to them in their references.

Could the team please review these two advisories and attribute the reporter credit to @hackchang so it is reflected in the global Advisory Database? Happy to provide any additional technical detail (CWE, CVSS vector, affected-range specifics) if useful.

Thank you for maintaining the Advisory Database.

— @hackchang