Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
The application constructs email content using `$_SERVER['HTTP_HOST']` or `$_SERVER['SERVER_NAME']` without validation. Attackers can manipulate the HTTP Host header to inject malicious domains into email links (such as verification or password reset URLs). If a user clicks the forged link, their verification token or credentials could be leaked to the attac
The Starlette application configures middleware but does not include `TrustedHostMiddleware`. If the application generates sensitive URLs (like password resets) based on the incoming Host header, this could lead to Host header injection vulnerabilities.
The 'reset_code' field is being written as an empty string ('') instead of NULL. This creates a shared sentinel value across all validated users; combined with a forgot-password gate that uses isset($_GET['c']) (which is true for ''), an unauthenticated attacker can request /forgot_password/?c= and match any user whose reset_code was stored as ''. Use NULL t
A URL is being generated in a function related to authentication, invitations, or password tokens without first explicitly setting a trusted host in the router context. This could lead to Host Header Injection. If this URL is sent to a user out-of-band (e.g., via email), an attacker could provide a malicious Host header and spoof the domain, leading to phish
