Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Constructing URLs or navigation attributes with unencoded string interpolation in query parameters can lead to query parameter injection and URL parameter pollution. Use `URI.encode_query/1`, `URI.encode_www_form/1`, or structured route helpers instead of raw string interpolation.
Formatting git log output as raw XML tags with git placeholders and parsing it with SimpleXMLElement can lead to denial of service or parsing failures if commit messages or metadata contain XML special characters or CDATA delimiters.
Git config values are serialized without quoting comment characters ('#', ';') or edge whitespace, which can lead to config directive injection.
HTML attribute key and value are appended to a markup buffer without escaping, which can lead to Cross-Site Scripting (XSS).
Double quotes are being escaped using a backslash instead of HTML/markup entity escaping. In HTML attributes, backslash escaping does not neutralize quotes and allows attribute breakout and Cross-Site Scripting (XSS). Use proper HTML entity escaping methods such as `Strings.escapeMarkup(...)` or `StringEscapeUtils.escapeHtml4(...)`.
Pre-escaping text with HTML escape functions before passing it to a markdown converter leads to double-escaping of HTML entities. HTML sanitization should be performed on the generated HTML output rather than escaping input markdown.
Passing the return value of defaultNullLabel() directly to replaceComponentTagBody() can lead to Cross-Site Scripting (XSS) if defaultNullLabel() is overridden to return user-influenced data. Check getEscapeModelStrings() and escape markup using Strings.escapeMarkup().
Parameter key-value pairs are concatenated using structural delimiters ('=' and '&') without escaping via encodeURIComponent or unambiguous serialization framing. This permits delimiter injection that can lead to cache-key collisions or parameter spoofing.
Unsanitized rune written to output buffer without control character validation. C0/C1 control runes (such as ESC, BEL, CSI, OSC) can lead to terminal escape sequence injection.
Replacing quotes with backticks without escaping backticks or template interpolation expressions (${...}) allows code injection when the generated template literal is evaluated. Use a dedicated escaping utility like jsesc.
Converting quotes to backticks via replace or replaceAll creates template literals without escaping interpolation sequences (`${...}`) or backticks. This allows code injection in generated JavaScript/TypeScript. Use a dedicated escaping function or library such as `jsesc`.
Replacing quote characters with backticks on stringified data without escaping template literal interpolations (`${...}`) or backticks can lead to arbitrary code execution in generated code. Use a secure escaping utility like `jsesc`.
Naively replacing quotes with backticks without escaping backslashes, backticks, or interpolation expressions (${...}) allows template literal injection when generating code. Use a secure escaping library such as 'jsesc' with backtick options instead.
Unescaped user name concatenated into HTML message preview allows HTML injection and stored XSS (CVE-2026-65644).
A function accepts a dynamic quote character but hardcodes a literal quote (`'\\''` or `'\"'`) when calling `mysql_real_escape_string_quote`. This mismatch can lead to SQL injection if the dynamic quote is a backtick or differs from the hardcoded value. Pass the dynamic quote parameter to the escaping function instead.
The `mysql_real_escape_string_quote` function is called with a hardcoded character literal `$LIT`, despite the enclosing function accepting a dynamic `$QUOTE` parameter. This can lead to injection vulnerabilities (like SQL injection) if the dynamically provided quote differs from the escaped quote character. Update the call to use the dynamically provided qu
A URL validation check using `.lower().startswith(...)` does not unquote the URL first. This allows bypassing the validation using percent-encoded characters (like `javascript%3a`). Ensure that you fully URL-decode the string (e.g., using `urllib.parse.unquote`) before converting it to lowercase and checking its scheme against blocklists.
A string object is instantiated and forcibly marked as `isEscaped = true` without undergoing prior HTML escaping or sanitization. This bypasses output encoding mechanisms (often in frameworks like Hono) and can lead to Cross-Site Scripting (XSS) if untrusted input is included. Ensure strings are properly escaped before manually marking them as HTML-escaped.
Quotes are escaped without escaping backslashes first. If the input contains a backslash preceding a quote, the backslash will escape the escape character itself, leaving the quote unescaped and potentially allowing code injection when the generated string is evaluated.
Detected interpolation of variables into a generated Python script template using quoted f-string syntax (`"{...}"`) instead of safe representation (`{!r}`). An attacker controlling the variable contents can escape the string literal and execute arbitrary code.
Constructing cookie header payloads via unvalidated concatenation with semicolons can permit cookie attribute injection, leading to session anomalies or overriding security flags.
Applying HTML escaping before Markdown conversion (e.g., via goldmark) leads to double-escaped entities in the final output. This generally produces a functional presentation layer bug rather than a true security boundary flaw.
Unescaped pattern expression is directly appended into dynamically generated Java code, which can lead to arbitrary code execution when the generated code is compiled. Ensure strings embedded into generated Java source are properly escaped using ValueExpression.escapeJavaString.
Direct formatting of unescaped map values into a configuration template (e.g., "%s %s") inside a loop can lead to configuration injection. If attackers control the input map, they may include structural characters (like newlines) to bypass directive boundaries and execute arbitrary code. Ensure values are string-escaped or strictly validated against linebrea
