Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Directly loading 'META-INF/helidon/serial-config.properties' using ClassLoader.getResources() may fail to discover deserialization filter configurations in single-JAR or modular deployments.
Calling `SkipClean(true)` on a `gorilla/mux` router disables automatic URL path cleaning. This allows unnormalized path payloads (like using multiple consecutive slashes) to bypass path-based access control, routing, or authorization rules that rely on normalized paths. If the underlying filesystem or downstream service subsequently cleans the path, an attac
A ZIP file is extracted using `unzip_file()`, followed by a shallow directory listing such as `glob()` or `scandir()` in a loop for validation or cleanup. This pattern is highly insecure because shallow loops do not recursively traverse subdirectories. Attackers can bypass file-type blacklists (e.g., `.php` checks) by placing malicious scripts within a neste
Passing untrusted user input directly into the require() function without proper validation or sanitization can possibly cause a vulnerability known as remote code execution (RCE). An attacker could manipulate the input to load and execute arbitrary code from external sources, potentially leading to severe security breaches such as data theft, system comprom
JSCWE-706
