swisskyrepo / PayloadsAllTheThings

1. high Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.php:1 100%
2. high Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.jpg^shell.php:1 100%
3. high Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.jpg.php:1 100%
4. high Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.jpeg.php:1 100%
5. high Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.gif^shell.php:1 100%
6. high Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.phtml:1 100%
7. high Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.png.php:1 100%
8. high Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input that is used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.png^shell.php:1 100%
9. high Semgrep Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. /Upload Insecure Files/Extension PHP/shell.jpg^shell.php:1 99%
10. high Semgrep Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. /Upload Insecure Files/Extension PHP/shell.gif^shell.php:1 99%
11. high Semgrep Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. /Upload Insecure Files/Extension PHP/shell.jpeg.php:1 99%
12. high Semgrep Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. /Upload Insecure Files/Extension PHP/shell.jpg.php:1 99%
13. high Semgrep Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. /Upload Insecure Files/Extension PHP/shell.php:1 99%
14. high Semgrep Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. /Upload Insecure Files/Extension PHP/shell.phtml:1 99%
15. high Semgrep Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. /Upload Insecure Files/Extension PHP/shell.png.php:1 99%
16. high Semgrep Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. /Upload Insecure Files/Extension PHP/shell.png^shell.php:1 99%
17. high Semgrep Semgrep found a bash reverse shell /.github/hopla_config.json:1129 99%
18. high Semgrep linux shadow file detected /Command Injection/README.md:275 99%
19. high Semgrep linux shadow file detected /Command Injection/README.md:74 99%
20. high Semgrep linux shadow file detected /Command Injection/README.md:250 99%
21. high Semgrep linux shadow file detected /Command Injection/README.md:259 99%
22. high Semgrep linux shadow file detected /Command Injection/README.md:269 99%
23. high Semgrep linux shadow file detected /Command Injection/README.md:272 99%
24. high Semgrep linux shadow file detected /Command Injection/README.md:287 99%
25. high Semgrep linux shadow file detected /Command Injection/README.md:281 99%
26. high Semgrep Google OAuth Access Token detected /Server Side Request Forgery/SSRF-Cloud-Instances.md:210 99%
27. high Semgrep Google OAuth Access Token detected /Server Side Request Forgery/SSRF-Cloud-Instances.md:195 99%
28. high ClamAV ClamAV detected: Img.Phishing.SvgJsPhishing-10044283-0 /XSS Injection/Intruders/xss_alert_identifiable.txt 98%
29. high ClamAV ClamAV detected: Img.Exploit.CVE_2021_22204-9911806-0 /Upload Insecure Files/Picture Metadata/CVE-2021-22204_exiftool_revshell.jpg 98%
30. high ClamAV ClamAV detected: Img.Exploit.CVE_2021_22204-9911806-0 /Upload Insecure Files/Picture Metadata/CVE-2021-22204_exiftool_echo.jpg 98%
31. high ClamAV ClamAV detected: Eicar-Signature /Upload Insecure Files/EICAR/eicar.txt 98%
32. high ClamAV ClamAV detected: Img.Phishing.SvgJsPhishing-10044283-0 /XSS Injection/README.md 98%
33. high ClamAV ClamAV detected: Img.Phishing.SvgJsPhishing-10044283-0 /XSS Injection/2 - XSS Polyglot.md 98%
34. high ClamAV ClamAV detected: Img.Phishing.SvgJsPhishing-10044283-0 /XSS Injection/Intruders/IntrudersXSS.txt 98%
35. high ClamAV ClamAV detected: Img.Phishing.SvgJsPhishing-10044283-0 /XSS Injection/Intruders/XSS_Polyglots.txt 98%
36. high ClamAV ClamAV detected: Img.Phishing.SvgJsPhishing-10044283-0 /XSS Injection/Intruders/JHADDIX_XSS.txt 98%
37. high Semgrep Generic API Key detected /Insecure Source Code Management/Files/github-dorks.txt:257 52%
38. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /Web Sockets/README.md:110 51%
39. high Semgrep The 'phpinfo' function may reveal sensitive information about your environment. /Upload Insecure Files/Extension PHP/phpinfo.jpg.php:1 50%
40. high Semgrep The 'phpinfo' function may reveal sensitive information about your environment. /Upload Insecure Files/Extension PHP/phpinfo.php:1 50%
41. high Semgrep The 'phpinfo' function may reveal sensitive information about your environment. /Upload Insecure Files/Extension PHP/phpinfo.phtml:1 50%
42. high Semgrep JWT token detected /JSON Web Token/README.md:38 50%
43. high Semgrep JWT token detected /JSON Web Token/README.md:124 50%
44. high Semgrep JWT token detected /JSON Web Token/README.md:177 50%
45. high Semgrep JWT token detected /JSON Web Token/README.md:232 50%
46. high Semgrep JWT token detected /JSON Web Token/README.md:247 50%
47. high Semgrep JWT token detected /JSON Web Token/README.md:307 50%
48. high Semgrep JWT token detected /JSON Web Token/README.md:308 50%
49. high Semgrep JWT token detected /JSON Web Token/README.md:336 50%
50. high Semgrep JWT token detected /JSON Web Token/README.md:376 50%
51. high Semgrep JWT token detected /JSON Web Token/README.md:377 50%
52. high Semgrep JWT token detected /JSON Web Token/README.md:380 50%
53. high Semgrep JWT token detected /JSON Web Token/README.md:381 50%
54. high Semgrep JWT token detected /JSON Web Token/README.md:382 50%
55. high Semgrep JWT token detected /JSON Web Token/README.md:383 50%
56. high Semgrep JWT token detected /JSON Web Token/README.md:384 50%
57. high Semgrep Executing non-constant commands. This can lead to command injection. /Upload Insecure Files/Extension PHP/shell.gif^shell.php:1 43%
58. high Semgrep Executing non-constant commands. This can lead to command injection. /Upload Insecure Files/Extension PHP/shell.jpeg.php:1 43%
59. high Semgrep Executing non-constant commands. This can lead to command injection. /Upload Insecure Files/Extension PHP/shell.jpg.php:1 43%
60. high Semgrep Executing non-constant commands. This can lead to command injection. /Upload Insecure Files/Extension PHP/shell.jpg^shell.php:1 43%
61. high Semgrep Executing non-constant commands. This can lead to command injection. /Upload Insecure Files/Extension PHP/shell.php:1 43%
62. high Semgrep Executing non-constant commands. This can lead to command injection. /Upload Insecure Files/Extension PHP/shell.phtml:1 43%
63. high Semgrep Executing non-constant commands. This can lead to command injection. /Upload Insecure Files/Extension PHP/shell.png.php:1 43%
64. high Semgrep Executing non-constant commands. This can lead to command injection. /Upload Insecure Files/Extension PHP/shell.png^shell.php:1 43%
65. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /CVE Exploits/README.md 39%
66. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /Upload Insecure Files/Picture ImageMagick/imagetragik1_payload_imageover_reverse_shell_devtcp.jpg 39%
67. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /Upload Insecure Files/Picture Metadata/CVE-2021-22204_exiftool_revshell.jpg 39%
68. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /.github/hopla_config.json 39%
69. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /Server Side Template Injection/Python.md 39%
70. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /Server Side Template Injection/Intruder/ssti.fuzz 39%
71. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /Prototype Pollution/README.md 39%
72. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /SQL Injection/SQLite Injection.md 39%
73. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /SQL Injection/PostgreSQL Injection.md 39%
74. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /Upload Insecure Files/README.md 39%
75. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /Upload Insecure Files/Picture ImageMagick/imagemagik_ghostscript_reverse_shell.jpg 39%
76. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /Upload Insecure Files/Picture ImageMagick/imagetragik2_ubuntu_shell2.jpg 39%
77. high YARA YARA rule matched: detect_reverse_shell — Reverse shell command patterns /Command Injection/Intruder/command_exec.txt 39%
78. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /File Inclusion/LFI-to-RCE.md 33%
79. high YARA YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code /.github/hopla_config.json 18%
80. high YARA YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code /File Inclusion/Intruders/List_Of_File_To_Include.txt 18%
81. high YARA YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code /File Inclusion/Intruders/LFI-FD-check.txt 18%
82. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /File Inclusion/Wrappers.md 3%
83. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /XSS Injection/Intruders/IntrudersXSS.txt 3%
84. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /XSS Injection/Intruders/BRUTELOGIC-XSS-STRINGS.txt 3%
85. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /XSS Injection/1 - XSS Filter Bypass.md 3%
86. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /File Inclusion/LFI-to-RCE.md 1%
87. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /Command Injection/Intruder/command_exec.txt 1%
88. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /File Inclusion/Wrappers.md 1%
89. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /Prompt Injection/README.md 1%
90. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/Intruders/XSSDetection.txt 1%
91. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/Intruders/XSS_Polyglots.txt 1%
92. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/Intruders/JHADDIX_XSS.txt 1%
93. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/README.md 1%
94. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/2 - XSS Polyglot.md 1%
95. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/Intruders/IntrudersXSS.txt 1%
96. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/Intruders/xss_alert.txt 1%
97. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/Intruders/xss_alert_identifiable.txt 1%
98. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/1 - XSS Filter Bypass.md 1%
99. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /XSS Injection/Intruders/RSNAKE_XSS.txt 1%
100. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /File Inclusion/Intruders/JHADDIX_LFI.txt 0%
101. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /SQL Injection/SQLite Injection.md 0%
102. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /File Inclusion/Intruders/List_Of_File_To_Include.txt 0%
103. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /File Inclusion/Intruders/Linux-files.txt 0%
104. medium Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.png^shell.php:1 100%
105. medium Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.gif^shell.php:1 100%
106. medium Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.jpeg.php:1 100%
107. medium Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.jpg.php:1 100%
108. medium Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.jpg^shell.php:1 100%
109. medium Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.php:1 100%
110. medium Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.phtml:1 100%
111. medium Semgrep Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. In PHP, it is possible to use `escapeshellcmd(...)` and `escapeshellarg(...)` to correctly sanitize input when used respectively as system commands or command arguments. /Upload Insecure Files/Extension PHP/shell.png.php:1 100%
112. medium Semgrep User input is passed to a function that executes a shell command. This can lead to remote code execution. /Upload Insecure Files/Extension PHP/shell.gif^shell.php:1 100%
113. medium Semgrep User input is passed to a function that executes a shell command. This can lead to remote code execution. /Upload Insecure Files/Extension PHP/shell.jpeg.php:1 100%
114. medium Semgrep User input is passed to a function that executes a shell command. This can lead to remote code execution. /Upload Insecure Files/Extension PHP/shell.jpg.php:1 100%
115. medium Semgrep User input is passed to a function that executes a shell command. This can lead to remote code execution. /Upload Insecure Files/Extension PHP/shell.jpg^shell.php:1 100%
116. medium Semgrep User input is passed to a function that executes a shell command. This can lead to remote code execution. /Upload Insecure Files/Extension PHP/shell.php:1 100%
117. medium Semgrep User input is passed to a function that executes a shell command. This can lead to remote code execution. /Upload Insecure Files/Extension PHP/shell.phtml:1 100%
118. medium Semgrep User input is passed to a function that executes a shell command. This can lead to remote code execution. /Upload Insecure Files/Extension PHP/shell.png.php:1 100%
119. medium Semgrep User input is passed to a function that executes a shell command. This can lead to remote code execution. /Upload Insecure Files/Extension PHP/shell.png^shell.php:1 100%
120. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/check-markdown.yml:8 52%
121. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/check-markdown.yml:12 52%
122. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/check-markdown.yml:18 52%
123. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/mkdocs-build.yml:11 52%
124. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/mkdocs-build.yml:16 52%
125. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/mkdocs-build.yml:26 52%
126. medium Semgrep This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. /.github/overrides/main.html:17 36%
127. medium Semgrep This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files. /.github/overrides/main.html:16 36%
128. medium Bandit Call to requests without timeout /File Inclusion/Files/uploadlfi.py:11 22%
129. medium Bandit Call to requests without timeout /File Inclusion/Files/uploadlfi.py:17 22%
130. medium Bandit Call to requests without timeout /File Inclusion/Files/LFI2RCE.py:54 22%
131. low Semgrep Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. /File Inclusion/Files/uploadlfi.py:11 32%
132. low Semgrep Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. /File Inclusion/Files/uploadlfi.py:17 32%
133. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /Insecure Source Code Management/Git.md 0%
134. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /CSV Injection/README.md 0%
135. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /NoSQL Injection/README.md 0%
136. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /Prompt Injection/README.md 0%
137. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /Web Sockets/README.md 0%
138. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /LDAP Injection/README.md 0%
139. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /Server Side Include Injection/Files/ssi_esi.txt 0%
140. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /Upload Insecure Files/Picture ImageMagick/imagetragik1_payload_imageover_wget.gif 0%
141. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /File Inclusion/Files/LFI2RCE.py 0%
142. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /File Inclusion/Files/uploadlfi.py 0%
143. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /Command Injection/Intruder/command_exec.txt 0%
144. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /File Inclusion/LFI-to-RCE.md 0%
145. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /Server Side Request Forgery/README.md 0%
146. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /Upload Insecure Files/CVE FFmpeg HLS/gen_xbin_avi.py:44 0%
147. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /Upload Insecure Files/CVE FFmpeg HLS/gen_xbin_avi.py:75 0%
148. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /Upload Insecure Files/CVE FFmpeg HLS/gen_xbin_avi.py:78 0%
149. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /Upload Insecure Files/CVE FFmpeg HLS/gen_xbin_avi.py:82 0%
150. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /Upload Insecure Files/CVE FFmpeg HLS/gen_xbin_avi.py:110 0%
151. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /Upload Insecure Files/CVE FFmpeg HLS/gen_xbin_avi.py:148 0%

No findings match these filters. Clear filters