flatpressblog / flatpress

Large result: showing the top 206 of 225 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.

1. high Semgrep Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte. /fp-plugins/commentcenter/inc/editor.php:40 99%
2. high Semgrep Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte. /fp-plugins/commentcenter/inc/editor.php:40 99%
3. high Semgrep Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte. /fp-plugins/tag/inc/admin.php:619 99%
4. high Semgrep The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input. /admin/panels/widgets/admin.widgets.raw.php:49 98%
5. high Semgrep The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input. /admin/panels/widgets/admin.widgets.raw.php:49 98%
6. high Semgrep Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input. /admin/main.php:60 96%
7. high Semgrep Detected user input going into a php include or require command, which can lead to path traversal and sensitive data being exposed. These commands can also lead to code execution. Instead, allowlist files that the user can access or rigorously validate user input. /setup/main.php:87 96%
8. high Semgrep The 'phpinfo' function may reveal sensitive information about your environment. /admin/panels/maintain/admin.maintain.php:672 50%
9. high Semgrep Executing non-constant commands. This can lead to command injection. /setup/lib/step2.lib.php:20 43%
10. high Semgrep Executing non-constant commands. This can lead to command injection. /setup/lib/step2.lib.php:56 43%
11. high Semgrep Executing non-constant commands. This can lead to command injection. /setup/lib/step2.lib.php:47 43%
12. high Semgrep Executing non-constant commands. This can lead to command injection. /setup/lib/step2.lib.php:38 43%
13. high Semgrep Executing non-constant commands. This can lead to command injection. /setup/lib/step2.lib.php:29 43%
14. high Semgrep Executing non-constant commands. This can lead to command injection. /setup/lib/step2.lib.php:11 43%
15. high Semgrep Executing non-constant commands. This can lead to command injection. /setup/lib/main.lib.php:199 43%
16. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/tagdb.php:267 43%
17. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/storage/plugin.storage.php:658 43%
18. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/mastodon/plugin.mastodon.php:12248 43%
19. high Semgrep Executing non-constant commands. This can lead to command injection. /admin/panels/plugin/admin.plugin.php:61 43%
20. high Semgrep Executing non-constant commands. This can lead to command injection. /admin/panels/plugin/admin.plugin.php:96 43%
21. high Semgrep Executing non-constant commands. This can lead to command injection. /admin/panels/widgets/admin.widgets.default.php:366 43%
22. high Semgrep Executing non-constant commands. This can lead to command injection. /contact.php:65 43%
23. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-includes/core/core.system.php:87 43%
24. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/mastodon/plugin.mastodon.php:12500 43%
25. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-includes/core/core.theme.php:244 43%
26. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/commentcenter/plugin.commentcenter.php:305 43%
27. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/commentcenter/plugin.commentcenter.php:429 43%
28. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/newsletter/regression-test/simulate_newsletter_plugin.php:360 43%
29. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/newsletter/regression-test/simulate_newsletter_plugin.php:448 43%
30. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/admin.php:593 43%
31. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/admin.php:604 43%
32. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/init.php:204 43%
33. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/tagdb.php:10 43%
34. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/tagdb.php:159 43%
35. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/tagdb.php:307 43%
36. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/widget.php:44 43%
37. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/widget.php:77 43%
38. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/widget.php:268 43%
39. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-plugins/tag/inc/widget.php:320 43%
40. high Semgrep Executing non-constant commands. This can lead to command injection. /setup.php:7 43%
41. high Semgrep Executing non-constant commands. This can lead to command injection. /setup/lib/main.lib.php:37 43%
42. high Semgrep Executing non-constant commands. This can lead to command injection. /setup/lib/main.lib.php:203 43%
43. high Semgrep Evaluating non-constant commands. This can lead to command injection. /fp-includes/smarty-5.8.4/src/Cacheresource/Custom.php:161 43%
44. high Semgrep Evaluating non-constant commands. This can lead to command injection. /fp-includes/smarty-5.8.4/src/Template/Compiled.php:162 43%
45. high Semgrep Executing non-constant commands. This can lead to command injection. /admin/panels/entry/admin.entry.write.php:179 43%
46. high Semgrep Executing non-constant commands. This can lead to command injection. /admin/panels/static/admin.static.write.php:170 43%
47. high Semgrep Executing non-constant commands. This can lead to command injection. /comments.php:156 43%
48. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-includes/core/core.config.php:78 43%
49. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-includes/core/core.system.php:198 43%
50. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-includes/core/core.system.php:199 43%
51. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-includes/core/core.users.php:185 43%
52. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-includes/core/core.wp-options.php:30 43%
53. high Semgrep Executing non-constant commands. This can lead to command injection. /fp-includes/fp-smartyplugins/modifier.is_external_url.php:166 43%
54. high Semgrep Evaluating non-constant commands. This can lead to command injection. /fp-includes/smarty-5.8.4/src/Cacheresource/File.php:107 43%
55. high Semgrep Evaluating non-constant commands. This can lead to command injection. /fp-includes/smarty-5.8.4/src/Cacheresource/KeyValueStore.php:129 43%
56. high Semgrep Evaluating non-constant commands. This can lead to command injection. /fp-includes/smarty-5.8.4/src/Compile/Modifier/Base.php:45 43%
57. high Semgrep Evaluating non-constant commands. This can lead to command injection. /fp-includes/smarty-5.8.4/src/FunctionHandler/Math.php:124 43%
58. high Semgrep Evaluating non-constant commands. This can lead to command injection. /fp-includes/smarty-5.8.4/src/Runtime/TplFunctionRuntime.php:110 43%
59. high Semgrep Evaluating non-constant commands. This can lead to command injection. /fp-includes/smarty-5.8.4/src/Template/Compiled.php:257 43%
60. high Semgrep Executing non-constant commands. This can lead to command injection. /admin/main.php:217 42%
61. high Semgrep Executing non-constant commands. This can lead to command injection. /contact.php:263 42%
62. high Semgrep Executing non-constant commands. This can lead to command injection. /index.php:243 42%
63. high Semgrep Executing non-constant commands. This can lead to command injection. /login.php:172 42%
64. high Semgrep Executing non-constant commands. This can lead to command injection. /search.php:7 42%
65. high Semgrep Executing non-constant commands. This can lead to command injection. /sitemap.php:65 42%
66. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /fp-includes/core/core.utils.php 1%
67. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /fp-plugins/jquery/res/jqueryui/1.14.2/external/jquery/jquery.js 1%
68. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js 1%
69. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /fp-includes/smarty-5.8.4/src/FunctionHandler/Mailto.php 1%
70. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /fp-plugins/photoswipe/res/jquery-3.7.1/jquery-3.7.1.js 1%
71. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /fp-plugins/jquery/res/jqueryui/1.14.2/jquery-ui.js 1%
72. medium Semgrep RegExp() called with a `className` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js:1531 100%
73. medium Semgrep RegExp() called with a `className` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /fp-plugins/jquery/res/jqueryui/1.14.2/external/jquery/jquery.js:1651 100%
74. medium Semgrep RegExp() called with a `className` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /fp-plugins/photoswipe/res/jquery-3.7.1/jquery-3.7.1.js:1651 100%
75. medium Semgrep RegExp() called with a `className` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /fp-plugins/photoswipe/res/photoswipe-4.1.3/photoswipe.js:54 100%
76. medium Semgrep RegExp() called with a `className` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /fp-plugins/photoswipe/res/photoswipe-4.1.3/photoswipe.js:63 100%
77. medium Semgrep RegExp() called with a `types` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js:4798 100%
78. medium Semgrep <- A new object is created where the class name is based on user input. This could lead to remote code execution, as it allows to instantiate any class in the application. /admin/main.php:67 100%
79. medium Semgrep Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte. /fp-plugins/commentcenter/inc/editor.php:39 98%
80. medium Semgrep Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte. /fp-plugins/commentcenter/inc/editor.php:40 98%
81. medium Semgrep Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte. /fp-plugins/prettyurls/plugin.prettyurls.php:495 98%
82. medium Semgrep Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with `htmlspecialchars` or use automatic context-aware escaping with a template engine such as Latte. /fp-plugins/seometataginfo/plugin.seometataginfo.php:251 98%
83. medium Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /admin/main.php:60 98%
84. medium Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. In PHP, this can lead to both local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /setup/main.php:87 98%
85. medium Semgrep Callable based on user input risks remote code execution. /admin/includes/panels.prototypes.php:173 97%
86. medium Semgrep User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host. /fp-plugins/commentcenter/inc/admin.php:204 56%
87. medium Semgrep File name based on user input risks server-side request forgery. /admin/main.php:58 55%
88. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/seometataginfo/plugin.seometataginfo.php:2142 55%
89. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/seometataginfo/plugin.seometataginfo.php:2142 55%
90. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/seometataginfo/plugin.seometataginfo.php:2142 55%
91. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/seometataginfo/plugin.seometataginfo.php:232 55%
92. medium Semgrep File name based on user input risks server-side request forgery. /admin/panels/uploader/admin.uploader.thumb.php:108 55%
93. medium Semgrep File name based on user input risks server-side request forgery. /fp-includes/smarty-5.8.4/src/FunctionHandler/HtmlImage.php:116 55%
94. medium Semgrep File name based on user input risks server-side request forgery. /fp-includes/smarty-5.8.4/src/FunctionHandler/HtmlImage.php:119 55%
95. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/commentcenter/inc/admin.php:652 55%
96. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/mediamanager/panels/panel.mediamanager.file.php:263 55%
97. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/mediamanager/panels/panel.mediamanager.file.php:267 55%
98. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/seometataginfo/plugin.seometataginfo.php:2085 55%
99. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/mediamanager/panels/panel.mediamanager.file.php:351 55%
100. medium Semgrep File name based on user input risks server-side request forgery. /fp-includes/smarty-5.8.4/src/FunctionHandler/HtmlImage.php:115 55%
101. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/mediamanager/panels/panel.mediamanager.file.php:347 55%
102. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/seometataginfo/plugin.seometataginfo.php:2089 55%
103. medium Semgrep File name based on user input risks server-side request forgery. /fp-plugins/seometataginfo/plugin.seometataginfo.php:2093 55%
104. medium Semgrep Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues /fp-plugins/bbcode/plugin.bbcode.php:517 54%
105. medium Semgrep Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions. /fp-plugins/feed/res/feed.css.php:3 53%
106. medium Semgrep The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`. /fp-plugins/mastodon/plugin.mastodon.php:2221 52%
107. medium Semgrep The function `openssl_decrypt` returns either a string of the decrypted data on success or `false` on failure. If the failure case is not handled, this could lead to undefined behavior in your application. Please handle the case where `openssl_decrypt` returns `false`. /fp-plugins/newsletter/plugin.newsletter.php:525 52%
108. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/phpstan.yml:22 52%
109. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/codeql-analysis.yml:29 52%
110. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/codeql-analysis.yml:32 52%
111. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/codeql-analysis.yml:37 52%
112. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/codeql-analysis.yml:40 52%
113. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/phpstan.yml:19 52%
114. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js:2802 44%
115. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js:1609 44%
116. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js:1955 44%
117. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js:1970 44%
118. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js:1978 44%
119. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js:1983 44%
120. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/photoswipe/res/jquery-3.7.1/jquery-3.7.1.js:3058 44%
121. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/photoswipe/res/jquery-3.7.1/jquery-3.7.1.js:2730 44%
122. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/photoswipe/res/jquery-3.7.1/jquery-3.7.1.js:2208 44%
123. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/photoswipe/res/jquery-3.7.1/jquery-3.7.1.js:2203 44%
124. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/photoswipe/res/jquery-3.7.1/jquery-3.7.1.js:2195 44%
125. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/photoswipe/res/jquery-3.7.1/jquery-3.7.1.js:1729 44%
126. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jquery/4.0.0/jquery-4.0.0.js:2472 44%
127. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jqueryui/1.14.2/external/jquery/jquery.js:1729 44%
128. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jqueryui/1.14.2/external/jquery/jquery.js:2180 44%
129. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jqueryui/1.14.2/external/jquery/jquery.js:2195 44%
130. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jqueryui/1.14.2/external/jquery/jquery.js:2203 44%
131. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jqueryui/1.14.2/external/jquery/jquery.js:2208 44%
132. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/photoswipe/res/jquery-3.7.1/jquery-3.7.1.js:2180 44%
133. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jqueryui/1.14.2/jquery-ui.js:413 44%
134. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jqueryui/1.14.2/external/jquery/jquery.js:3058 44%
135. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /fp-plugins/jquery/res/jqueryui/1.14.2/external/jquery/jquery.js:2730 44%
136. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /fp-plugins/lastcomments/plugin.lastcomments.php:49 36%
137. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /fp-plugins/lastcomments/plugin.lastcomments.php:55 36%
138. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /fp-includes/core/core.entry.php:742 36%
139. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /fp-includes/fp-smartyplugins/block.cache.php:393 36%
140. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /fp-plugins/lastcomments/plugin.lastcomments.php:183 36%
141. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /fp-plugins/lastcomments/plugin.lastcomments.php:224 36%
142. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /fp-plugins/prettyurls/plugin.prettyurls.php:85 36%
143. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /fp-plugins/prettyurls/plugin.prettyurls.php:806 36%
144. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /admin/panels/maintain/admin.maintain.php:586 21%
145. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:336 21%
146. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.comment.php:303 21%
147. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:355 21%
148. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:374 21%
149. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:395 21%
150. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:414 21%
151. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:433 21%
152. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:452 21%
153. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:471 21%
154. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/tag/inc/admin.php:381 21%
155. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/tag/inc/admin.php:387 21%
156. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/tag/inc/admin.php:437 21%
157. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:301 21%
158. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.comment.php:260 21%
159. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.connection.php:1183 21%
160. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.entry.php:179 21%
161. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.fileio.php:57 21%
162. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/smarty-5.8.4/src/Cacheresource/File.php:273 21%
163. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/smarty-5.8.4/src/Smarty.php:1380 21%
164. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mastodon/plugin.mastodon.php:1665 21%
165. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mediamanager/inc/usage-index.php:525 21%
166. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/newsletter/plugin.newsletter.php:1523 21%
167. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:311 21%
168. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:279 21%
169. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:260 21%
170. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/support/plugin.support.php:241 21%
171. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/storage/plugin.storage.php:52 21%
172. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/storage/plugin.storage.php:51 21%
173. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mediamanager/panels/panel.mediamanager.file.php:213 21%
174. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/newsletter/plugin.newsletter.php:1747 21%
175. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/seometataginfo/inc/migrate_data.php:110 21%
176. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/calendar/plugin.calendar.php:129 21%
177. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/commentcenter/inc/admin.php:551 21%
178. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/seometataginfo/inc/hw-helpers.php:179 21%
179. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/seometataginfo/inc/migrate_data.php:57 21%
180. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/seometataginfo/inc/migrate_data.php:88 21%
181. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mastodon/plugin.mastodon.php:1206 20%
182. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /admin.php:137 20%
183. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /admin/panels/maintain/admin.maintain.php:583 20%
184. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.connection.php:1266 20%
185. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.entry.php:154 20%
186. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.fileio.php:56 20%
187. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mediamanager/inc/usage-index.php:543 20%
188. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mastodon/plugin.mastodon.php:11624 20%
189. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mastodon/plugin.mastodon.php:11615 20%
190. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mastodon/plugin.mastodon.php:11611 20%
191. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mastodon/plugin.mastodon.php:8173 20%
192. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mastodon/plugin.mastodon.php:4326 20%
193. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mastodon/plugin.mastodon.php:3873 20%
194. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.fileio.php:196 20%
195. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/mastodon/plugin.mastodon.php:1200 20%
196. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-plugins/commentcenter/plugin.commentcenter.php:457 20%
197. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/smarty-5.8.4/src/Smarty.php:1785 20%
198. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/smarty-5.8.4/src/Smarty.php:1772 20%
199. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/smarty-5.8.4/src/Smarty.php:1761 20%
200. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/smarty-5.8.4/src/Smarty.php:1750 20%
201. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/smarty-5.8.4/src/Smarty.php:1738 20%
202. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/smarty-5.8.4/src/Cacheresource/File.php:330 20%
203. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/fp-smartyplugins/block.cache.php:424 20%
204. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.users.php:205 20%
205. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.gallery.php:158 20%
206. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /fp-includes/core/core.filesystem.php:208 20%

No findings match these filters. Clear filters