Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A Livewire form containing a password input uses the `wire:submit` directive without the `.prevent` modifier. In older versions of Livewire, this omission causes the browser to perform a native HTML GET submission by default. This causes sensitive credentials (like user passwords) to leak directly into the URL query string, where they can be cached in browse
Magic login link containing an authentication token is returned to the caller after being delivered by email. If the caller exposes this return value through an HTTP response, an unauthenticated attacker who knows a target email can retrieve the login token directly (CVE-2026-39912). Return only a boolean success indicator instead of the link.
Retrieving sensitive data from URL query parameters risks exposing it in server access logs, reverse proxy logs, and browser history. Read sensitive data from the HTTP request body instead (e.g., via JSON payload or form data).
