Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Calling `extract()` without specifying `EXTR_SKIP` allows array keys to overwrite function arguments and local variables, potentially leading to arbitrary template inclusion or code execution.
Calling `extract()` without `EXTR_SKIP` allows array elements to overwrite existing local scope variables. If the extracted array contains user input, an attacker can override critical variables such as file paths or template names, leading to Local File Inclusion or authentication bypass. Always pass `EXTR_SKIP` to `extract()`.
