Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
File operations within this class rely on a static path validation method rather than an instance-bound workspace isolation check. This can lead to directory traversal or arbitrary file manipulation. Migrate the method to an instance method taking `self` and ensure paths are resolved safely using an isolated workspace context.
The 'reset_code' field is being written as an empty string ('') instead of NULL. This creates a shared sentinel value across all validated users; combined with a forgot-password gate that uses isset($_GET['c']) (which is true for ''), an unauthenticated attacker can request /forgot_password/?c= and match any user whose reset_code was stored as ''. Use NULL t
