aimeos / pagible

1. high GuardDog Detects destructive operations (recursive deletion, wiping) [threat-filesystem-destruction] /admin/cypress/unit/assets/base.cy.js:38 99%
2. high GuardDog Detects destructive operations (recursive deletion, wiping) [threat-filesystem-destruction] /admin/cypress/unit/components/ConfirmDialog.cy.js:5 99%
3. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/split.yml:69 57%
4. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/trigger-circleci.yml:58 57%
5. high Semgrep Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". /.github/workflows/trigger-circleci.yml:73 57%
6. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /admin/dist/assets/Text-az4PXMME.js 3%
7. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /webhooks/src/WebhookClient.php 1%
8. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /admin/dist/assets/Text-az4PXMME.js 1%
9. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /admin/dist/assets/graphql-B0HGj01_.js 1%
10. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /admin/dist/assets/pusher-BULhsvYZ.js 1%
11. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /admin/dist/assets/markdown-mzzmKsY5.js 1%
12. medium Semgrep RegExp() called with a `term` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /theme/public/cms.js:80 100%
13. medium Semgrep RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /theme/public/prism.js:4 100%
14. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /admin/js/components/ChatDialog.vue:341 100%
15. medium Semgrep Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to XSS vulnerabilities. Only use HTML interpolation on trusted content and never on user-provided content. /admin/js/components/ChatDialog.vue:342 100%
16. medium GuardDog Detects unicode homoglyphs and uncommon characters used for obfuscation [threat-runtime-obfuscation-unicode] /admin/dist/assets/VSelect-rGtv6eLt.js:1 98%
17. medium Semgrep A secret is exposed in the workflow-level `env:` block, making it available to every job and step in this workflow — including any untrusted code run in pull-request workflows. Scope secrets as narrowly as possible: prefer step-level `env:` so the secret is only available where it is actually needed. /.github/workflows/split.yml:8 98%
18. medium Semgrep Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions. /src/server.php:46 53%
19. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/split.yml:66 52%
20. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/split.yml:85 52%
21. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/split.yml:102 52%
22. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/trigger-circleci.yml:11 52%
23. medium Semgrep RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /theme/public/prism.js:3 43%
24. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /src/Commands/Install.php:139 21%
25. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /backup/src/Commands/Restore.php:718 20%
26. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /core/src/Uploads.php:187 20%
27. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /core/src/Uploads.php:178 20%
28. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /backup/src/Commands/Restore.php:1238 20%
29. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /backup/src/Commands/Restore.php:1133 20%
30. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /backup/src/Commands/Restore.php:114 20%
31. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /backup/src/Commands/Backup.php:496 20%
32. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /backup/src/Commands/Backup.php:313 20%
33. low Semgrep Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. /admin/js/i18n.js:145 33%
34. low Dependency checker Loose version constraint: '@playwright/test^1.50' — attacker could push malicious update package.json 2%

No findings match these filters. Clear filters