Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
An unconditional 'continue' follows a specific exclusion condition. For loop control flows where the excluded value is intended to fall through and process subsequent configurations (such as SSR handler assignments), an unconditional continue mistakenly skips the rest of the loop block. Ensure the continue is guarded conditionally or correctly isolated.
Trade order controller method accepts an orderId from the HTTP request, loads the TradeOrder by that attacker-supplied numeric id, and acts on it (initiate payment, debit balance, cancel, refund) without binding @SessionAttribute SysUser to verify that the authenticated caller actually owns the referenced order. Only the siteId is validated, so any authentic
Grouping vulnerabilities only by scanner without report_type can lead to erroneous vulnerability resolution when different report types share the same scanner.
Grouping scans or vulnerabilities solely by `scanner` without including `scan_type` or `report_type` can result in improper vulnerability resolution or cross-contamination if a single scanner produces multiple types of reports. Group items using a composite key.
