Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A libcurl request is created from a non-constant URL while redirect following is enabled (CURLOPT_FOLLOWLOCATION = true) and the URL is neither validated nor restricted with CURLOPT_PROTOCOLS. An attacker-controlled URL here enables server-side request forgery (CWE-918): libcurl's default protocol set exposes file://, dict:// and gopher://, a redirect from a
This function verifies an inbound HTTP request signature with openssl_verify() but accepts the request without any anti-replay control: the signed Date header is never checked against the server clock and accepted signatures are never recorded. A captured, validly signed request (for example an ActivityPub inbox POST performing Delete, Update, Follow or Undo
A dynamic value is spliced directly into a SQL LIKE pattern without escaping the LIKE metacharacters backslash, percent and underscore. Ordinary SQL string-literal escaping (e.g. DbService::escape()) does not neutralize them, so an attacker-controlled value such as a self-registered username of `___` or `%%%` becomes a wildcard pattern (e.g. list LIKE "%___%
A credential-bearing integration row reaches the client response without redaction. Integration configs are write-only credentials: Slack access tokens, incoming-webhook URLs, webhook header values (Authorization bearers) and `enc:` ciphertext for S3/GCS keys are persisted in recoverable form so the delivery worker can read them raw, and `read` on a project
A value parsed by std::stoi()/std::stol()/std::stoll() with base 16 is used as an array or container index without validating the parsed characters with std::isxdigit. Base-16 std::stoi() accepts a leading '-' sign and throws std::invalid_argument on non-hex characters, so attacker-controlled text shaped like "<0xXX>" but containing a sign or non-hex charact
Untrusted template code is compiled or evaluated with Function/eval in the host realm instead of a hardened VM realm. Compiling a stored template with new Function() in the worker's own realm, and handing it the host payload object by reference, lets $payload.constructor.constructor resolve to the host Function constructor and execute arbitrary code (sandbox
A value is interpolated into the SQL text of a SELECT/JOIN expression as an identifier: an identifier list (`${...join(', ')}`) inside a SELECT subquery, or a raw `${name} as alias` select term. SQL identifiers cannot be neutralized with value escaping, so a crafted filter, breakdown or property name can terminate the enclosing subquery, supply its own FROM/
Customer PII is disclosed through a redirect URL: the order reference ($ORDER->reference) and the customer e-mail are appended to a redirect link based only on a user-controlled identifier, without verifying the request's "key" parameter against $ORDER->secure_key. An unauthenticated attacker can iterate sequential cart/order ids and read the victim's order
An rsa.PrivateKey is assembled from parsed values and passed to Validate()/Precompute() without first bounding the modulus size (e.g. if $n.BitLen() > limit) and checking p * q == n. When the key material originates from untrusted input (JSON/JWK/protocol fields), crafted large or degenerate RSA parameters make validation consume cubic CPU time on Go 1.24+,
A deserialization routine reads a parsed node's element list ($NODE.$FIELD) and consumes its `length` to size an allocation or bound a decoder loop without first verifying that the list is a real Array. Because the node comes from untrusted deserialized input, an attacker can substitute an array-like such as {"length": 2000000000} or {"length": "Infinity"}:
A sequence/iterator object is constructed from raw deserialized node metadata ($NODE.s throw index and $NODE.l done index) without first validating that both are in-range integers. An attacker who controls the serialized payload can supply an out-of-range done index so the reconstructed iterator never reaches its done condition; application code that iterate
Deserialized value $VAL is laundered through a TypeScript type assertion ($TYPE) instead of being proven by a runtime identity check. Untrusted serialized input can place an arbitrary object (or a plugin-produced value) behind the deserialized value, so downstream consumers invoke attacker-chosen methods on it (e.g. `on`, `next`, iterator protocol). Validate
Caller-controlled data reaches the command text of a PowerShell execution without allow-list (whitelist) neutralization. PowerShell - unlike a POSIX shell - normalizes Unicode typographic quotes (U+2018-U+201E) and dashes (U+2013-U+2015) into real string delimiters, so a character blacklist that strips ASCII metacharacters still leaves alternate delimiter gl
Whitelisted HTTP endpoint $FUNC resolves a CRM record from the caller-controlled parameter $PARAM via $LOOKUP and returns the match without enforcing document read permissions. The lookup runs raw query-builder queries that bypass the Frappe permission engine, and @frappe.whitelist() only requires authentication, so any authenticated user can enumerate Leads
Request-controlled URI path data is exploded/imploded into segments and concatenated onto a filesystem base directory, and the resulting path is used in a filesystem operation (read or existence probe) without realpath() canonicalization and a root-prefix containment check (resolved path must equal the intended root or start with root . DIRECTORY_SEPARATOR).
Raw request input read with GETPOST(..., 'none') is sanitized only with dol_sanitizePathName(), a path-name sanitizer that preserves shell metacharacters (&, ;, |, <, >, +). When this value is used as an OS command path/name (persisted in a constant such as SYSTEMTOOLS_MYSQLDUMP and later executed by Utils::dumpDatabase(), or passed directly to exec/system/p
An unescaped variable/property is concatenated into a single-quoted SQL string literal (the '...".".$var."' shape). A single quote inside the value terminates the SQL literal and allows SQL injection. CVE-2026-116218 exploited exactly this in CompanyBankAccount::create(), where the API-controlled 'type' property broke out of the INSERT INTO ...societe_rib VA
A remote ActivityPub activity replayed by the outbox-sync loop mutates a mirrored local entry (EntryManager delete/update/create) after resolving the actor-controlled object ID to a local entry via a source-URL triple lookup, without verifying that the syncing actor owns that entry. A malicious or compromised remote server can serve a poisoned outbox so that
Uploaded file content is persisted verbatim: move_uploaded_file() copies $_FILES[...]['tmp_name'] into $DEST and the surrounding function never sanitizes the stored file. Upload endpoints commonly accept .svg (and .html), and a stored .svg is served back as image/svg+xml, so attacker-supplied <script> or onload= markup executes in the site origin for every u
Non-atomic single-use token (nonce) check: a replayed value is rejected with a SELECT (`->count()` / `->exists()`), but the token itself is only INSERTed later through a separate write. Concurrent requests replaying the same SAML assertion all run the SELECT before any sibling request commits its INSERT, so every request passes the guard and mints an authent
The result of ldap_start_tls() is discarded. If the StartTLS upgrade of the LDAP connection fails (e.g. an on-path attacker answers the StartTLS extended request with a protocol error), execution continues on the still-cleartext connection and a subsequent ldap_bind() sends the bind DN and password in plaintext. Fail closed instead, e.g. if (!ldap_start_tls(
Socialite/SSO callback resolves a local account purely by matching the provider-supplied email ($SOCIALUSER->getEmail()) against an account column and then creates an authenticated session with Auth::login() without ever enforcing the account's activated state. A deactivated (or soft-deleted) account whose username/email equals a provider-controlled email ca
Root containment is validated before a suffix-stripping transformation is applied to the already-validated local path, so the path that is actually used was never checked. A name equal to ".." + suffix (e.g. "...rclonelink") passes the containment check while the suffix is still attached and then collapses to ".." after the trim, escaping the destination roo
A value read from an OAuth callback form ($REQ.Form.Get / $REQ.FormValue) flows into persistent configuration ($CFG.Set) or into an http(s) URL without being checked against an allowlist. The localhost OAuth callback is an unauthenticated endpoint (any web page in the user's browser can request it while the flow is waiting), so a forged callback can plant an
