{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:36:33.450314Z","repo":{"ref":{"host":"github.com","owner":"xl7dev","name":"WebShell"},"default_branch":"master","clone_url":"https://github.com/xl7dev/WebShell.git","html_url":"https://github.com/xl7dev/WebShell","description":"Webshell && Backdoor Collection","stars":2018,"forks":1022,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":24551,"primary_language":"PHP","license_spdx":"GPL-2.0","created_at":"2015-10-16T20:56:15Z","pushed_at":"2020-04-06T15:58:22Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-10-25T13:26:18Z","owner_type":"User","release_assets":[]}},"commit_sha":"f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b","profile":{"lines_by_language":{"PHP":168670,"Python":5823,"C":3603,"Ruby":577,"JavaScript":532,"Shell":518,"Java":332,"PowerShell":316,"C++":37},"files_by_category":{"source":341,"other":268,"docs":48,"binary":47,"oversized":5,"config":3},"source_lines":180408,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.46,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":32.5,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":34.2,"duplication":4.5,"lint":88.3,"testing":0.0,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 36% of function code in complex or long functions; 52% duplicated lines. Weakest area: testing."},"security":{"score":35.3,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":25.9,"sast":0.0,"dependencies":100.0,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 1 possible secret(s) in the tree, 0 only in history; 3692 high-severity SAST findings. Weakest area: sast."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":4.0,"checked":4.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":25.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":168388.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2015-10":{"loc":0,"attributed_loc":0},"2016-03":{"loc":158812,"attributed_loc":0},"2016-04":{"loc":0,"attributed_loc":0},"2016-05":{"loc":179,"attributed_loc":0},"2016-06":{"loc":643,"attributed_loc":0},"2016-08":{"loc":2128,"attributed_loc":0},"2016-11":{"loc":3019,"attributed_loc":0},"2016-12":{"loc":3139,"attributed_loc":0},"2017-01":{"loc":168,"attributed_loc":0},"2017-04":{"loc":300,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":8.0,"flagged_units":0.0,"pre_ai_era_bursts":2.0,"pre_ai_era_measured_loc":9576.0,"pre_ai_era_burst_loc":5147.0,"measured_loc":9576.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":754.75,"median_loc_per_hour":270.75,"pr_timed_units":0.0,"excluded_import_loc":158812.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["0c841d88c309ffd6e549b665450d52c6072cba64"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":182454.0,"index":0.082,"count:narrated_steps":13.0,"per_kloc:narrated_steps":0.071,"files:narrated_steps":7.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":1.0,"per_kloc:assistant_voice":0.005,"files:assistant_voice":1.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Now we make a list of the directories. */","ref":"Php/Ayyildiz Tim  -AYT- Shell v 2.1 Biz.php:227","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Ayyildiz Tim  -AYT- Shell v 2.1 Biz.php#L227","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: #STEP 0 -> Check if backdoor already installed...","ref":"Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php:212","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L212","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: #STEP 1 -> Login...","ref":"Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php:228","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L228","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: #STEP 2 -> Upload the malicious zip file...","ref":"Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php:249","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L249","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: #STEP 3 -> Select an album...","ref":"Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php:315","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L315","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: #STEP 4 -> Insert .zip file in a valid album...","ref":"Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php:352","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L352","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: #STEP 5 -> Include the evil .zip file and launch commands...","ref":"Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php:394","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L394","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Now we make a list of the directories. */","ref":"Php/Matamu Mat.php:78","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Matamu Mat.php#L78","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":1.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":28.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Jsp/Oracle Database.jsp","line":13,"fingerprint":"Jsp/Oracle Database.jsp:generic-api-key:13"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Aspx/xxooxx.aspx","line":23,"fingerprint":"Aspx/xxooxx.aspx:generic-api-key:23"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Aspx/冰锋刺客.aspx","line":24,"fingerprint":"Aspx/冰锋刺客.aspx:generic-api-key:24"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Aspx/AspxSpy2014Final.aspx","line":38,"fingerprint":"Aspx/AspxSpy2014Final.aspx:generic-api-key:38"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/404 Not Found.php","line":10,"fingerprint":"Php/404 Not Found.php:generic-api-key:10"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/404.php","line":10,"fingerprint":"Php/404.php:generic-api-key:10"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Aspx/hec.aspx","line":23,"fingerprint":"Aspx/hec.aspx:generic-api-key:23"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Aspx/WebAdmin 2.X Final.aspx","line":11,"fingerprint":"Aspx/WebAdmin 2.X Final.aspx:generic-api-key:11"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Aspx/wso.aspx","line":12,"fingerprint":"Aspx/wso.aspx:generic-api-key:12"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Aspx/ASPXspy.aspx","line":30,"fingerprint":"Aspx/ASPXspy.aspx:generic-api-key:30"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Aspx/专版aspx汗血宝马.aspx","line":24,"fingerprint":"Aspx/专版aspx汗血宝马.aspx:generic-api-key:24"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/boffmax_v1.0_web_shell_by_the-c0de_team(1).php","line":23,"fingerprint":"Php/boffmax_v1.0_web_shell_by_the-c0de_team(1).php:generic-api-key:23"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Aspx/view.aspx","line":12,"fingerprint":"Aspx/view.aspx:generic-api-key:12"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/Silic Group Hacker Army - BlackBap.Org.php","line":19,"fingerprint":"Php/Silic Group Hacker Army - BlackBap.Org.php:generic-api-key:19"},{"rule_id":"gitleaks/private-key","severity":"high","message":"Possible private-key secret in the current tree","path":"SSH/custom-ssh-backdoor/test_rsa.key","line":1,"fingerprint":"SSH/custom-ssh-backdoor/test_rsa.key:private-key:1"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Pl/pps-pl/pps-v1.0.pl","line":5,"fingerprint":"Pl/pps-pl/pps-v1.0.pl:generic-api-key:5"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Pl/pps-pl/pps-v3.0.pl","line":4,"fingerprint":"Pl/pps-pl/pps-v3.0.pl:generic-api-key:4"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Pl/pps-pl/pps-v4.0.pl","line":3,"fingerprint":"Pl/pps-pl/pps-v4.0.pl:generic-api-key:3"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Pl/pps-pl/pps-v3.5.pl","line":7,"fingerprint":"Pl/pps-pl/pps-v3.5.pl:generic-api-key:7"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Pl/telnet.pl","line":45,"fingerprint":"Pl/telnet.pl:generic-api-key:45"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/r57shell127.php","line":1343,"fingerprint":"Php/r57shell127.php:generic-api-key:1343"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/DAws.php","line":648,"fingerprint":"Php/DAws.php:generic-api-key:648"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/r57_kartal.php","line":1091,"fingerprint":"Php/r57_kartal.php:generic-api-key:1091"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/r57_iFX.php","line":1120,"fingerprint":"Php/r57_iFX.php:generic-api-key:1120"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/SnIpEr_SA Shell.php","line":1431,"fingerprint":"Php/SnIpEr_SA Shell.php:generic-api-key:1431"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/WSO2.7 404 Error Web Shell.php","line":4,"fingerprint":"Php/WSO2.7 404 Error Web Shell.php:generic-api-key:4"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/r57_Mohajer22.php","line":1518,"fingerprint":"Php/r57_Mohajer22.php:generic-api-key:1518"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/EgY_SpIdEr ShElL V2.php","line":3183,"fingerprint":"Php/EgY_SpIdEr ShElL V2.php:generic-api-key:3183"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"Php/r57shell v.1.42 - Edited By KingDefacer.php","line":3836,"fingerprint":"Php/r57shell v.1.42 - Edited By KingDefacer.php:generic-api-key:3836"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":5769.0,"findings_high":3692.0,"findings_medium":2075.0,"findings_low":2.0,"weighted_findings":6817.513,"scanned_lines":180092.0,"parse_errors":20.0},"findings":[{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":198,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:198"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":200,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:200"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":204,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:204"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":228,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:228"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":230,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:230"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":236,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:236"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":238,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:238"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":243,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:243"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":251,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:251"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"Php/12309.php","line":251,"fingerprint":"php.lang.security.injection.tainted-sql-string:Php/12309.php:251"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":323,"fingerprint":"php.lang.security.exec-use:Php/12309.php:323"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":325,"fingerprint":"php.lang.security.exec-use:Php/12309.php:325"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":327,"fingerprint":"php.lang.security.exec-use:Php/12309.php:327"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":329,"fingerprint":"php.lang.security.exec-use:Php/12309.php:329"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":331,"fingerprint":"php.lang.security.exec-use:Php/12309.php:331"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":334,"fingerprint":"php.lang.security.exec-use:Php/12309.php:334"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":439,"fingerprint":"php.lang.security.exec-use:Php/12309.php:439"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":441,"fingerprint":"php.lang.security.exec-use:Php/12309.php:441"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":444,"fingerprint":"php.lang.security.exec-use:Php/12309.php:444"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":448,"fingerprint":"php.lang.security.exec-use:Php/12309.php:448"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":453,"fingerprint":"php.lang.security.exec-use:Php/12309.php:453"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":609,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:609"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":618,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:618"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":625,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:625"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":637,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:637"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":639,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:639"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":818,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:818"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":818,"fingerprint":"php.lang.security.exec-use:Php/12309.php:818"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":821,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:821"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":821,"fingerprint":"php.lang.security.exec-use:Php/12309.php:821"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":824,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:824"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":824,"fingerprint":"php.lang.security.exec-use:Php/12309.php:824"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":828,"fingerprint":"php.lang.security.exec-use:Php/12309.php:828"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":828,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:828"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":829,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:829"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":832,"fingerprint":"php.lang.security.exec-use:Php/12309.php:832"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":832,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:832"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":834,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:834"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":853,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:853"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":853,"fingerprint":"php.lang.security.exec-use:Php/12309.php:853"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload \"\".$_POST[\"pcfile\"].\"\" [confidence low]","path":"Php/12309.php","line":859,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:859"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":860,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:860"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":864,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:864"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":869,"fingerprint":"php.lang.security.eval-use:Php/12309.php:869"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":885,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:885"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function file_get_contents with payload $_POST[\"filename\"] [confidence low]","path":"Php/12309.php","line":940,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:940"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":941,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:941"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":984,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:984"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"Php/12309.php","line":989,"fingerprint":"php.lang.security.injection.tainted-sql-string:Php/12309.php:989"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":993,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:993"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1065,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1065"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1078,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1078"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1080,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1080"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1082,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1082"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1112,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1112"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"Php/12309.php","line":1116,"fingerprint":"php.lang.security.injection.tainted-sql-string:Php/12309.php:1116"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1137,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1137"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function file_get_contents with payload trim($_POST[\"filee\"]) [confidence low]","path":"Php/12309.php","line":1140,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1140"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload trim($_POST[\"files\"]) [confidence low]","path":"Php/12309.php","line":1142,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1142"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1145,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1145"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1148,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1148"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1150,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1150"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1158,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1158"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1166,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1166"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1174,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1174"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1192,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1192"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1194,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1194"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function readfile with payload $_POST[\"file\"] [confidence low]","path":"Php/12309.php","line":1211,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1211"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1230,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1230"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":1520,"fingerprint":"php.lang.security.exec-use:Php/12309.php:1520"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":1520,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:1520"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":1523,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:1523"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":1523,"fingerprint":"php.lang.security.exec-use:Php/12309.php:1523"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":1528,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:1528"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":1528,"fingerprint":"php.lang.security.exec-use:Php/12309.php:1528"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":1533,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:1533"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":1533,"fingerprint":"php.lang.security.exec-use:Php/12309.php:1533"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":1536,"fingerprint":"php.lang.security.exec-use:Php/12309.php:1536"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":1536,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:1536"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/12309.php","line":1543,"fingerprint":"php.lang.security.exec-use:Php/12309.php:1543"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/12309.php","line":1543,"fingerprint":"php.lang.security.tainted-exec:Php/12309.php:1543"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload trim($_POST['path']) [confidence low]","path":"Php/12309.php","line":1561,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1561"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload trim($_POST['path']) [confidence low]","path":"Php/12309.php","line":1578,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1578"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload trim($_POST['path']) [confidence low]","path":"Php/12309.php","line":1595,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1595"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload trim($_POST['path']) [confidence low]","path":"Php/12309.php","line":1611,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1611"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload trim($_POST['path']) [confidence low]","path":"Php/12309.php","line":1628,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1628"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload trim($_POST['path']) [confidence low]","path":"Php/12309.php","line":1645,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1645"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload trim($_POST['path']) [confidence low]","path":"Php/12309.php","line":1661,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1661"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1686,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1686"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1791,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1791"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1803,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1803"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1886,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1886"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":1910,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:1910"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":1919,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:1919"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":1922,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:1922"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":1937,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:1937"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":1940,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:1940"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":1943,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:1943"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":1946,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:1946"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/12309.php","line":1952,"fingerprint":"php.lang.security.weak-crypto:Php/12309.php:1952"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST[\"dir\"].\"/\".$_POST[\"file\"] [confidence low]","path":"Php/12309.php","line":1982,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1982"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1983,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1983"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":1987,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:1987"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST[\"dir\"].\"/.htaccess\" [confidence low]","path":"Php/12309.php","line":1995,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:1995"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST[\"dir\"].\"/\".$_POST[\"file\"] [confidence low]","path":"Php/12309.php","line":2016,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:2016"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":2017,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:2017"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":2021,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:2021"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST[\"dir\"].\"/.htaccess\" [confidence low]","path":"Php/12309.php","line":2029,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:2029"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST[\"dir\"].\"/\".$_POST[\"file\"] [confidence low]","path":"Php/12309.php","line":2043,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:2043"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":2044,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:2044"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/12309.php","line":2048,"fingerprint":"php.lang.security.injection.echoed-request:Php/12309.php:2048"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST[\"dir\"].\"/.htaccess\" [confidence low]","path":"Php/12309.php","line":2050,"fingerprint":"php.lang.security.php-ssrf:Php/12309.php:2050"},{"rule_id":"opengrep/php.lang.security.phpinfo-use","severity":"high","message":"The 'phpinfo' function may reveal sensitive information about your environment. [confidence medium]","path":"Php/12309.php","line":2062,"fingerprint":"php.lang.security.phpinfo-use:Php/12309.php:2062"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/404 Not Found.php","line":8,"fingerprint":"php.lang.security.weak-crypto:Php/404 Not Found.php:8"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/404 Not Found.php","line":36,"fingerprint":"php.lang.security.eval-use:Php/404 Not Found.php:36"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/404.php","line":8,"fingerprint":"php.lang.security.weak-crypto:Php/404.php:8"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/404.php","line":36,"fingerprint":"php.lang.security.eval-use:Php/404.php:36"},{"rule_id":"opengrep/php.lang.security.phpinfo-use","severity":"high","message":"The 'phpinfo' function may reveal sensitive information about your environment. [confidence medium]","path":"Php/404webshell.php","line":247,"fingerprint":"php.lang.security.phpinfo-use:Php/404webshell.php:247"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/404webshell.php","line":1951,"fingerprint":"php.lang.security.exec-use:Php/404webshell.php:1951"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/404webshell.php","line":2283,"fingerprint":"php.lang.security.exec-use:Php/404webshell.php:2283"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/404webshell.php","line":2293,"fingerprint":"php.lang.security.exec-use:Php/404webshell.php:2293"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/404webshell.php","line":2301,"fingerprint":"php.lang.security.exec-use:Php/404webshell.php:2301"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/404webshell.php","line":2305,"fingerprint":"php.lang.security.exec-use:Php/404webshell.php:2305"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/404webshell.php","line":2873,"fingerprint":"php.lang.security.weak-crypto:Php/404webshell.php:2873"},{"rule_id":"opengrep/php.lang.security.phpinfo-use","severity":"high","message":"The 'phpinfo' function may reveal sensitive information about your environment. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":75,"fingerprint":"php.lang.security.phpinfo-use:Php/A robust backdoor script made by Daniel Berliner.php:75"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function readfile with payload $_REQUEST['dl'] [confidence low]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":87,"fingerprint":"php.lang.security.php-ssrf:Php/A robust backdoor script made by Daniel Berliner.php:87"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":91,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:91"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":112,"fingerprint":"php.lang.security.tainted-exec:Php/A robust backdoor script made by Daniel Berliner.php:112"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":112,"fingerprint":"php.lang.security.exec-use:Php/A robust backdoor script made by Daniel Berliner.php:112"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":120,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:120"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":147,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:147"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":149,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:149"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":178,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:178"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":179,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:179"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":186,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:186"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":193,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:193"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":209,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:209"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":210,"fingerprint":"php.lang.security.exec-use:Php/A robust backdoor script made by Daniel Berliner.php:210"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":210,"fingerprint":"php.lang.security.tainted-exec:Php/A robust backdoor script made by Daniel Berliner.php:210"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":249,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:249"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":288,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:288"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":297,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:297"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_REQUEST['ef'] [confidence low]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":374,"fingerprint":"php.lang.security.php-ssrf:Php/A robust backdoor script made by Daniel Berliner.php:374"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":389,"fingerprint":"php.lang.security.injection.echoed-request:Php/A robust backdoor script made by Daniel Berliner.php:389"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function file_get_contents with payload $_REQUEST['ef'] [confidence low]","path":"Php/A robust backdoor script made by Daniel Berliner.php","line":389,"fingerprint":"php.lang.security.php-ssrf:Php/A robust backdoor script made by Daniel Berliner.php:389"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/AK-74 Security Team Web Shell Beta Version.php","line":396,"fingerprint":"php.lang.security.eval-use:Php/AK-74 Security Team Web Shell Beta Version.php:396"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/AK-74 Security Team Web Shell Beta Version.php","line":423,"fingerprint":"php.lang.security.tainted-exec:Php/AK-74 Security Team Web Shell Beta Version.php:423"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST['rename'] [confidence low]","path":"Php/AK-74 Security Team Web Shell Beta Version.php","line":433,"fingerprint":"php.lang.security.php-ssrf:Php/AK-74 Security Team Web Shell Beta Version.php:433"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_SESSION['currentdir'].'/'.$_POST['filecreate'] [confidence low]","path":"Php/AK-74 Security Team Web Shell Beta Version.php","line":520,"fingerprint":"php.lang.security.php-ssrf:Php/AK-74 Security Team Web Shell Beta Version.php:520"},{"rule_id":"opengrep/php.lang.security.phpinfo-use","severity":"high","message":"The 'phpinfo' function may reveal sensitive information about your environment. [confidence medium]","path":"Php/AK-74 Security Team Web Shell Beta Version.php","line":619,"fingerprint":"php.lang.security.phpinfo-use:Php/AK-74 Security Team Web Shell Beta Version.php:619"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/AK-74 Security Team Web Shell Beta Version.php","line":638,"fingerprint":"php.lang.security.injection.echoed-request:Php/AK-74 Security Team Web Shell Beta Version.php:638"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/AK-74 Security Team.php","line":396,"fingerprint":"php.lang.security.eval-use:Php/AK-74 Security Team.php:396"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/AK-74 Security Team.php","line":423,"fingerprint":"php.lang.security.tainted-exec:Php/AK-74 Security Team.php:423"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST['rename'] [confidence low]","path":"Php/AK-74 Security Team.php","line":433,"fingerprint":"php.lang.security.php-ssrf:Php/AK-74 Security Team.php:433"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_SESSION['currentdir'].'/'.$_POST['filecreate'] [confidence low]","path":"Php/AK-74 Security Team.php","line":520,"fingerprint":"php.lang.security.php-ssrf:Php/AK-74 Security Team.php:520"},{"rule_id":"opengrep/php.lang.security.phpinfo-use","severity":"high","message":"The 'phpinfo' function may reveal sensitive information about your environment. [confidence medium]","path":"Php/AK-74 Security Team.php","line":619,"fingerprint":"php.lang.security.phpinfo-use:Php/AK-74 Security Team.php:619"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/AK-74 Security Team.php","line":638,"fingerprint":"php.lang.security.injection.echoed-request:Php/AK-74 Security Team.php:638"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/Ajax_PHP Command Shell.php","line":367,"fingerprint":"php.lang.security.tainted-exec:Php/Ajax_PHP Command Shell.php:367"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ajax_PHP Command Shell.php","line":367,"fingerprint":"php.lang.security.exec-use:Php/Ajax_PHP Command Shell.php:367"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/Ajax_PHP Command Shell.php","line":383,"fingerprint":"php.lang.security.tainted-exec:Php/Ajax_PHP Command Shell.php:383"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ajax_PHP Command Shell.php","line":383,"fingerprint":"php.lang.security.exec-use:Php/Ajax_PHP Command Shell.php:383"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ajax_PHP Command Shell.php","line":389,"fingerprint":"php.lang.security.exec-use:Php/Ajax_PHP Command Shell.php:389"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ajax_PHP Command Shell.php","line":389,"fingerprint":"php.lang.security.injection.printed-request:Php/Ajax_PHP Command Shell.php:389"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/Ajax_PHP Command Shell.php","line":389,"fingerprint":"php.lang.security.tainted-exec:Php/Ajax_PHP Command Shell.php:389"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST['filetosave'] [confidence low]","path":"Php/Ajax_PHP Command Shell.php","line":403,"fingerprint":"php.lang.security.php-ssrf:Php/Ajax_PHP Command Shell.php:403"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function file_get_contents with payload getcwd().\"/\".basename($_GET['zip']).\". [confidence low]","path":"Php/Ani-Shell.php","line":75,"fingerprint":"php.lang.security.php-ssrf:Php/Ani-Shell.php:75"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":81,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:81"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":680,"fingerprint":"php.lang.security.exec-use:Php/Ani-Shell.php:680"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":686,"fingerprint":"php.lang.security.exec-use:Php/Ani-Shell.php:686"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":691,"fingerprint":"php.lang.security.exec-use:Php/Ani-Shell.php:691"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":716,"fingerprint":"php.lang.security.exec-use:Php/Ani-Shell.php:716"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":724,"fingerprint":"php.lang.security.exec-use:Php/Ani-Shell.php:724"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":734,"fingerprint":"php.lang.security.exec-use:Php/Ani-Shell.php:734"},{"rule_id":"opengrep/php.lang.security.md5-loose-equality","severity":"high","message":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues [confidence low]","path":"Php/Ani-Shell.php","line":786,"fingerprint":"php.lang.security.md5-loose-equality:Php/Ani-Shell.php:786"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":885,"fingerprint":"php.lang.security.exec-use:Php/Ani-Shell.php:885"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":888,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:888"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":1231,"fingerprint":"php.lang.security.eval-use:Php/Ani-Shell.php:1231"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1266,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1266"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1270,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1270"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1351,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1351"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1351,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1351"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1428,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1428"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/Ani-Shell.php","line":1428,"fingerprint":"php.lang.security.weak-crypto:Php/Ani-Shell.php:1428"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1503,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1503"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":1601,"fingerprint":"php.lang.security.exec-use:Php/Ani-Shell.php:1601"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Ani-Shell.php","line":1717,"fingerprint":"php.lang.security.exec-use:Php/Ani-Shell.php:1717"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1846,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1846"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1859,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1859"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1860,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1860"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1861,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1861"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1862,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1862"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1981,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1981"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1983,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1983"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":1984,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:1984"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST['file'] [confidence low]","path":"Php/Ani-Shell.php","line":2236,"fingerprint":"php.lang.security.php-ssrf:Php/Ani-Shell.php:2236"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2270,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2270"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2286,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2286"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2289,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2289"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function file_get_contents with payload $_GET['open'] [confidence low]","path":"Php/Ani-Shell.php","line":2293,"fingerprint":"php.lang.security.php-ssrf:Php/Ani-Shell.php:2293"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_GET['open'] [confidence low]","path":"Php/Ani-Shell.php","line":2300,"fingerprint":"php.lang.security.php-ssrf:Php/Ani-Shell.php:2300"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2342,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2342"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2345,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2345"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2368,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2368"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2425,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2425"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2425,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2425"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2426,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2426"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2427,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2427"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2428,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2428"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2429,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2429"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2430,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2430"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2439,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2439"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2439,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2439"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2440,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2440"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2441,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2441"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2442,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2442"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2443,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2443"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Ani-Shell.php","line":2444,"fingerprint":"php.lang.security.injection.echoed-request:Php/Ani-Shell.php:2444"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Antichat Shell v1.3.php","line":60,"fingerprint":"php.lang.security.exec-use:Php/Antichat Shell v1.3.php:60"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell v1.3.php","line":72,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell v1.3.php:72"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell v1.3.php","line":171,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell v1.3.php:171"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function readfile with payload $_POST['file'] [confidence low]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":13,"fingerprint":"php.lang.security.php-ssrf:Php/Antichat Shell. Modified by Go0o$E.php:13"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":226,"fingerprint":"php.lang.security.eval-use:Php/Antichat Shell. Modified by Go0o$E.php:226"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST['dif_name'] [confidence low]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":490,"fingerprint":"php.lang.security.php-ssrf:Php/Antichat Shell. Modified by Go0o$E.php:490"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":503,"fingerprint":"php.lang.security.injection.tainted-sql-string:Php/Antichat Shell. Modified by Go0o$E.php:503"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":510,"fingerprint":"php.lang.security.injection.tainted-sql-string:Php/Antichat Shell. Modified by Go0o$E.php:510"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":517,"fingerprint":"php.lang.security.injection.tainted-sql-string:Php/Antichat Shell. Modified by Go0o$E.php:517"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":523,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell. Modified by Go0o$E.php:523"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":617,"fingerprint":"php.lang.security.injection.tainted-sql-string:Php/Antichat Shell. Modified by Go0o$E.php:617"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":646,"fingerprint":"php.lang.security.injection.tainted-sql-string:Php/Antichat Shell. Modified by Go0o$E.php:646"},{"rule_id":"opengrep/php.lang.security.injection.tainted-sql-string","severity":"high","message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":673,"fingerprint":"php.lang.security.injection.tainted-sql-string:Php/Antichat Shell. Modified by Go0o$E.php:673"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":692,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell. Modified by Go0o$E.php:692"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":692,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell. Modified by Go0o$E.php:692"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell. Modified by Go0o$E.php","line":692,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell. Modified by Go0o$E.php:692"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Antichat Shell.php","line":181,"fingerprint":"php.lang.security.exec-use:Php/Antichat Shell.php:181"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell.php","line":193,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell.php:193"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell.php","line":297,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell.php:297"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell.php","line":309,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell.php:309"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell.php","line":311,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell.php:311"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell.php","line":356,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell.php:356"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Antichat Shell.php","line":363,"fingerprint":"php.lang.security.eval-use:Php/Antichat Shell.php:363"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat Shell.php","line":363,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat Shell.php:363"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Antichat_Shell_v1.3.php","line":60,"fingerprint":"php.lang.security.exec-use:Php/Antichat_Shell_v1.3.php:60"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat_Shell_v1.3.php","line":72,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat_Shell_v1.3.php:72"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Antichat_Shell_v1.3.php","line":171,"fingerprint":"php.lang.security.injection.echoed-request:Php/Antichat_Shell_v1.3.php:171"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Aria cPanel cracker version 1.0 - Edited By KingDefacer.php","line":35,"fingerprint":"php.lang.security.eval-use:Php/Aria cPanel cracker version 1.0 - Edited By KingDefacer.php:35"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Aria cPanel cracker version 1.0 - Edited By KingDefacer.php","line":65,"fingerprint":"php.lang.security.injection.printed-request:Php/Aria cPanel cracker version 1.0 - Edited By KingDefacer.php:65"},{"rule_id":"opengrep/php.lang.security.ftp-use","severity":"high","message":"FTP allows for unencrypted file transfers. Consider using an encrypted alternative. [confidence low]","path":"Php/Aria cPanel cracker version 1.0 - Edited By KingDefacer.php","line":139,"fingerprint":"php.lang.security.ftp-use:Php/Aria cPanel cracker version 1.0 - Edited By KingDefacer.php:139"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/B374k Beta ShElL V1.php","line":433,"fingerprint":"php.lang.security.eval-use:Php/B374k Beta ShElL V1.php:433"},{"rule_id":"opengrep/php.lang.security.backticks-use","severity":"high","message":"Backticks use may lead to command injection vulnerabilities. [confidence low]","path":"Php/Back Connect.php","line":36,"fingerprint":"php.lang.security.backticks-use:Php/Back Connect.php:36"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Backdoor php v0.1 Coded By Charlichaplin.php","line":134,"fingerprint":"php.lang.security.injection.echoed-request:Php/Backdoor php v0.1 Coded By Charlichaplin.php:134"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Backdoor php v0.1 Coded By Charlichaplin.php","line":170,"fingerprint":"php.lang.security.injection.echoed-request:Php/Backdoor php v0.1 Coded By Charlichaplin.php:170"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Backdoor php v0.1 Coded By Charlichaplin.php","line":173,"fingerprint":"php.lang.security.injection.echoed-request:Php/Backdoor php v0.1 Coded By Charlichaplin.php:173"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Backdoor php v0.1 Coded By Charlichaplin.php","line":175,"fingerprint":"php.lang.security.injection.echoed-request:Php/Backdoor php v0.1 Coded By Charlichaplin.php:175"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"Php/Backup script on server.php","line":124,"fingerprint":"php.lang.security.weak-crypto:Php/Backup script on server.php:124"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Backup script on server.php","line":162,"fingerprint":"php.lang.security.exec-use:Php/Backup script on server.php:162"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Backup script on server.php","line":168,"fingerprint":"php.lang.security.exec-use:Php/Backup script on server.php:168"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/C99madShell v. 2.0 madnet edition.php","line":6,"fingerprint":"php.lang.security.eval-use:Php/C99madShell v. 2.0 madnet edition.php:6"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload {$_POST['filename']} [confidence low]","path":"Php/Changing CHMOD Permissions Exploit.php","line":4,"fingerprint":"php.lang.security.php-ssrf:Php/Changing CHMOD Permissions Exploit.php:4"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/Command Shell.php","line":367,"fingerprint":"php.lang.security.tainted-exec:Php/Command Shell.php:367"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Command Shell.php","line":367,"fingerprint":"php.lang.security.exec-use:Php/Command Shell.php:367"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/Command Shell.php","line":383,"fingerprint":"php.lang.security.tainted-exec:Php/Command Shell.php:383"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Command Shell.php","line":383,"fingerprint":"php.lang.security.exec-use:Php/Command Shell.php:383"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/Command Shell.php","line":389,"fingerprint":"php.lang.security.exec-use:Php/Command Shell.php:389"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/Command Shell.php","line":389,"fingerprint":"php.lang.security.injection.printed-request:Php/Command Shell.php:389"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/Command Shell.php","line":389,"fingerprint":"php.lang.security.tainted-exec:Php/Command Shell.php:389"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST['filetosave'] [confidence low]","path":"Php/Command Shell.php","line":403,"fingerprint":"php.lang.security.php-ssrf:Php/Command Shell.php:403"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":372,"fingerprint":"php.lang.security.injection.echoed-request:Php/CrystalShell v.1.php:372"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":378,"fingerprint":"php.lang.security.injection.echoed-request:Php/CrystalShell v.1.php:378"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":462,"fingerprint":"php.lang.security.injection.echoed-request:Php/CrystalShell v.1.php:462"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":475,"fingerprint":"php.lang.security.injection.echoed-request:Php/CrystalShell v.1.php:475"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST['fileto'] [confidence low]","path":"Php/CrystalShell v.1.php","line":635,"fingerprint":"php.lang.security.php-ssrf:Php/CrystalShell v.1.php:635"},{"rule_id":"opengrep/php.lang.security.injection.printed-request","severity":"high","message":"`Printing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":642,"fingerprint":"php.lang.security.injection.printed-request:Php/CrystalShell v.1.php:642"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST['installpath'] [confidence low]","path":"Php/CrystalShell v.1.php","line":657,"fingerprint":"php.lang.security.php-ssrf:Php/CrystalShell v.1.php:657"},{"rule_id":"opengrep/php.lang.security.tainted-exec","severity":"high","message":"Executing non-constant commands. This can lead to command injection. You should use `escapeshellarg()` when using command. [confidence medium]","path":"Php/CrystalShell v.1.php","line":661,"fingerprint":"php.lang.security.tainted-exec:Php/CrystalShell v.1.php:661"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload stripslashes($_POST['editfile']) [confidence low]","path":"Php/CrystalShell v.1.php","line":668,"fingerprint":"php.lang.security.php-ssrf:Php/CrystalShell v.1.php:668"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":683,"fingerprint":"php.lang.security.injection.echoed-request:Php/CrystalShell v.1.php:683"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_POST['savefile'] [confidence low]","path":"Php/CrystalShell v.1.php","line":692,"fingerprint":"php.lang.security.php-ssrf:Php/CrystalShell v.1.php:692"},{"rule_id":"opengrep/php.lang.security.eval-use","severity":"high","message":"Evaluating non-constant commands. This can lead to command injection. [confidence low]","path":"Php/CrystalShell v.1.php","line":712,"fingerprint":"php.lang.security.eval-use:Php/CrystalShell v.1.php:712"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":730,"fingerprint":"php.lang.security.injection.echoed-request:Php/CrystalShell v.1.php:730"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":737,"fingerprint":"php.lang.security.injection.echoed-request:Php/CrystalShell v.1.php:737"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":805,"fingerprint":"php.lang.security.injection.echoed-request:Php/CrystalShell v.1.php:805"},{"rule_id":"opengrep/php.lang.security.injection.echoed-request","severity":"high","message":"`Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]","path":"Php/CrystalShell v.1.php","line":833,"fingerprint":"php.lang.security.injection.echoed-request:Php/CrystalShell v.1.php:833"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function fopen with payload $_REQUEST[edit] [confidence low]","path":"Php/Cyber Shell.php","line":436,"fingerprint":"php.lang.security.php-ssrf:Php/Cyber Shell.php:436"},{"rule_id":"opengrep/php.lang.security.php-ssrf","severity":"high","message":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Dangerous function readfile with payload $_REQUEST[edit] [confidence low]","path":"Php/Cyber Shell.php","line":436,"fingerprint":"php.lang.security.php-ssrf:Php/Cyber Shell.php:436"},{"rule_id":"opengrep/php.lang.security.md5-loose-equality","severity":"high","message":"Make sure comparisons involving md5 values are strict (use `===` not `==`) to avoid type juggling issues [confidence low]","path":"Php/DAws.php","line":20,"fingerprint":"php.lang.security.md5-loose-equality:Php/DAws.php:20"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":546,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:546"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":572,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:572"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":576,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:576"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":617,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:617"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":621,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:621"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":632,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:632"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":636,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:636"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":1003,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:1003"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":1017,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:1017"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":1030,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:1030"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":1041,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:1041"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":1052,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:1052"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":1065,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:1065"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":1115,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:1115"},{"rule_id":"opengrep/php.lang.security.exec-use","severity":"high","message":"Executing non-constant commands. This can lead to command injection. [confidence low]","path":"Php/DAws.php","line":1158,"fingerprint":"php.lang.security.exec-use:Php/DAws.php:1158"}],"evidence":[],"data":{"rulesets":["php","python","c","ruby","javascript","bash","java"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":3185.0,"function_nloc":45533.0,"mean_ccn":4.41,"p90_ccn":10.0,"complex_functions":177.0,"long_functions":48.0,"many_param_functions":1.0,"risky_nloc_share":0.3573},"findings":[],"evidence":[{"kind":"complex-function","description":"main in osx/osx-ping-backdoor/ping.c: complexity 216, 637 lines","ref":"osx/osx-ping-backdoor/ping.c","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/osx/osx-ping-backdoor/ping.c#L281","weight":1.0},{"kind":"complex-function","description":"actionSql in Php/WSO2.7 404 Error Web Shell.php: complexity 90, 335 lines","ref":"Php/WSO2.7 404 Error Web Shell.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/WSO2.7 404 Error Web Shell.php#L1610","weight":1.0},{"kind":"complex-function","description":"actionFilesMan in Php/WSO2.7 404 Error Web Shell.php: complexity 78, 189 lines","ref":"Php/WSO2.7 404 Error Web Shell.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/WSO2.7 404 Error Web Shell.php#L955","weight":1.0},{"kind":"complex-function","description":"scanneR in Php/PHPJackal v1.9.php: complexity 76, 179 lines","ref":"Php/PHPJackal v1.9.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/PHPJackal v1.9.php#L462","weight":1.0},{"kind":"complex-function","description":"brute in Php/gfs_sh.php: complexity 66, 212 lines","ref":"Php/gfs_sh.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/gfs_sh.php#L1015","weight":1.0},{"kind":"complex-function","description":"=::crack_md5 in Php/NetworkFileManagerPHP.php: complexity 63, 161 lines","ref":"Php/NetworkFileManagerPHP.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/NetworkFileManagerPHP.php#L3421","weight":1.0},{"kind":"complex-function","description":"filemanageR in Php/PHPJackal v1.9.php: complexity 61, 140 lines","ref":"Php/PHPJackal v1.9.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/PHPJackal v1.9.php#L728","weight":1.0},{"kind":"complex-function","description":"pr_pack in osx/osx-ping-backdoor/ping.c: complexity 60, 231 lines","ref":"osx/osx-ping-backdoor/ping.c","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/osx/osx-ping-backdoor/ping.c#L1130","weight":1.0},{"kind":"complex-function","description":"bypass_suhosin in Php/DAws.php: complexity 56, 228 lines","ref":"Php/DAws.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/DAws.php#L754","weight":0.9333333333333333},{"kind":"complex-function","description":"actionFile in Php/t57shell.php: complexity 50, 126 lines","ref":"Php/t57shell.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/t57shell.php#L102","weight":0.8333333333333334}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":132182.0,"duplicated_lines":68122.0,"duplicated_share":0.5154,"files":341.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: C/findsock.c:1 and Php/php-findsock-shell.php:2","ref":"C/findsock.c","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/C/findsock.c#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Javascript/JSRat.ps1:25 and Javascript/JSRat.ps1:258","ref":"Javascript/JSRat.ps1","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Javascript/JSRat.ps1#L25","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Mysql/mysql_audit_plugin/audit_null.c:12 and Php/r57shell.php:12","ref":"Mysql/mysql_audit_plugin/audit_null.c","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Mysql/mysql_audit_plugin/audit_null.c#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Php/12309.php:156 and Php/Antichat Shell v1.3.php:82","ref":"Php/12309.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/12309.php#L156","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Php/12309.php:976 and Php/12309.php:1103","ref":"Php/12309.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/12309.php#L976","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Php/404 Not Found.php:1 and Php/404.php:1","ref":"Php/404 Not Found.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/404 Not Found.php#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Php/404webshell.php:359 and Php/angel.php:178","ref":"Php/404webshell.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/404webshell.php#L359","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Php/404webshell.php:559 and Php/WSO2.7 404 Error Web Shell.php:233","ref":"Php/404webshell.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/404webshell.php#L559","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Php/404webshell.php:1687 and Php/Silic Group php Webshell v3.php:1215","ref":"Php/404webshell.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/404webshell.php#L1687","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Php/529.php:1 and Php/Security House - Shell Center - Edited By KingDefacer.php:1","ref":"Php/529.php","url":"https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/529.php#L1","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":61.0,"weighted_findings":89.75,"scanned_lines":180092.0,"category:best-practice":28.0,"category:correctness":30.0,"category:maintainability":3.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"Udp/LiveHack/livehack.py","line":49,"fingerprint":"python.lang.best-practice.open-never-closed:Udp/LiveHack/livehack.py:49"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"gdog/client.py","line":722,"fingerprint":"python.lang.best-practice.arbitrary-sleep:gdog/client.py:722"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"gdog/client.py","line":740,"fingerprint":"python.lang.best-practice.arbitrary-sleep:gdog/client.py:740"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"gdog/client.py","line":779,"fingerprint":"python.lang.best-practice.arbitrary-sleep:gdog/client.py:779"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"gdog/client.py","line":797,"fingerprint":"python.lang.best-practice.arbitrary-sleep:gdog/client.py:797"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"gdog/client.py","line":994,"fingerprint":"python.lang.best-practice.arbitrary-sleep:gdog/client.py:994"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"gdog/client.py","line":1106,"fingerprint":"python.lang.best-practice.arbitrary-sleep:gdog/client.py:1106"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"gdog/client.py","line":1111,"fingerprint":"python.lang.best-practice.arbitrary-sleep:gdog/client.py:1111"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/Phyton Shell.py","line":107,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/Phyton Shell.py:107"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/Phyton Shell.py","line":113,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/Phyton Shell.py:113"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/Phyton Shell.py","line":120,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/Phyton Shell.py:120"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/d00r_py3.py","line":116,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/d00r_py3.py:116"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/d00r_py3.py","line":124,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/d00r_py3.py:124"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/d00r_py3.py","line":133,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/d00r_py3.py:133"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/python3/Client.py","line":26,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/python3/Client.py:26"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/python3/Client.py","line":36,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/python3/Client.py:36"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/python3/Client.py","line":63,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/python3/Client.py:63"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/python3/Client.py","line":73,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/python3/Client.py:73"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"python/python3/Server.py","line":47,"fingerprint":"python.lang.best-practice.arbitrary-sleep:python/python3/Server.py:47"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"reGeorg-master/reGeorgSocksProxy.py","line":286,"fingerprint":"python.lang.best-practice.arbitrary-sleep:reGeorg-master/reGeorgSocksProxy.py:286"},{"rule_id":"opengrep/c.lang.correctness.incorrect-use-sscanf-fn","severity":"medium","message":"Avoid 'sscanf()' for number conversions. Its use can lead to undefined behavior, slow processing, and integer overflows. Instead prefer the 'strto*()' family of functions.","path":"C/cmd.c","line":28,"fingerprint":"c.lang.correctness.incorrect-use-sscanf-fn:C/cmd.c:28"},{"rule_id":"opengrep/c.lang.correctness.incorrect-use-ato-fn","severity":"medium","message":"Avoid the 'ato*()' family of functions. Their use can lead to undefined behavior, integer overflows, and lack of appropriate error handling. Instead prefer the 'strtol*()' family of functions.","path":"C/findsock.c","line":124,"fingerprint":"c.lang.correctness.incorrect-use-ato-fn:C/findsock.c:124"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"Udp/LiveHack/livehack.py","line":49,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:Udp/LiveHack/livehack.py:49"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"Udp/LiveHack/logger.py","line":4,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:Udp/LiveHack/logger.py:4"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"Udp/LiveHack/logger.py","line":8,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:Udp/LiveHack/logger.py:8"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"Udp/LiveHack/socket_live8.py","line":189,"fingerprint":"python.lang.maintainability.return-not-in-function:Udp/LiveHack/socket_live8.py:189"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"Udp/LiveHack/socket_live8.py","line":190,"fingerprint":"python.lang.maintainability.return-not-in-function:Udp/LiveHack/socket_live8.py:190"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"Udp/LiveHack/socket_live8.py","line":191,"fingerprint":"python.lang.maintainability.return-not-in-function:Udp/LiveHack/socket_live8.py:191"},{"rule_id":"opengrep/python.lang.correctness.unchecked-subprocess-call","severity":"medium","message":"This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead","path":"gdog/client.py","line":723,"fingerprint":"python.lang.correctness.unchecked-subprocess-call:gdog/client.py:723"},{"rule_id":"opengrep/python.lang.correctness.unchecked-subprocess-call","severity":"medium","message":"This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead","path":"gdog/client.py","line":741,"fingerprint":"python.lang.correctness.unchecked-subprocess-call:gdog/client.py:741"},{"rule_id":"opengrep/python.lang.correctness.unchecked-subprocess-call","severity":"medium","message":"This is not checking the return value of this subprocess call; if it fails no exception will be raised. Consider subprocess.check_call() instead","path":"gdog/client.py","line":798,"fingerprint":"python.lang.correctness.unchecked-subprocess-call:gdog/client.py:798"},{"rule_id":"opengrep/c.lang.correctness.incorrect-use-ato-fn","severity":"medium","message":"Avoid the 'ato*()' family of functions. Their use can lead to undefined behavior, integer overflows, and lack of appropriate error handling. Instead prefer the 'strtol*()' family of functions.","path":"icmp/icmpsh-s.c","line":236,"fingerprint":"c.lang.correctness.incorrect-use-ato-fn:icmp/icmpsh-s.c:236"},{"rule_id":"opengrep/c.lang.correctness.incorrect-use-ato-fn","severity":"medium","message":"Avoid the 'ato*()' family of functions. Their use can lead to undefined behavior, integer overflows, and lack of appropriate error handling. Instead prefer the 'strtol*()' family of functions.","path":"icmp/icmpsh-s.c","line":241,"fingerprint":"c.lang.correctness.incorrect-use-ato-fn:icmp/icmpsh-s.c:241"},{"rule_id":"opengrep/c.lang.correctness.incorrect-use-ato-fn","severity":"medium","message":"Avoid the 'ato*()' family of functions. Their use can lead to undefined behavior, integer overflows, and lack of appropriate error handling. Instead prefer the 'strtol*()' family of functions.","path":"icmp/icmpsh-s.c","line":249,"fingerprint":"c.lang.correctness.incorrect-use-ato-fn:icmp/icmpsh-s.c:249"},{"rule_id":"opengrep/c.lang.correctness.incorrect-use-ato-fn","severity":"medium","message":"Avoid the 'ato*()' family of functions. Their use can lead to undefined behavior, integer overflows, and lack of appropriate error handling. Instead prefer the 'strtol*()' family of functions.","path":"icmp/icmpsh-s.c","line":254,"fingerprint":"c.lang.correctness.incorrect-use-ato-fn:icmp/icmpsh-s.c:254"},{"rule_id":"opengrep/c.lang.correctness.incorrect-use-ato-fn","severity":"medium","message":"Avoid the 'ato*()' family of functions. Their use can lead to undefined behavior, integer overflows, and lack of appropriate error handling. Instead prefer the 'strtol*()' family of functions.","path":"pwnginx/client/functions.c","line":63,"fingerprint":"c.lang.correctness.incorrect-use-ato-fn:pwnginx/client/functions.c:63"},{"rule_id":"opengrep/c.lang.correctness.incorrect-use-ato-fn","severity":"medium","message":"Avoid the 'ato*()' family of functions. Their use can lead to undefined behavior, integer overflows, and lack of appropriate error handling. Instead prefer the 'strtol*()' family of functions.","path":"pwnginx/client/functions.c","line":161,"fingerprint":"c.lang.correctness.incorrect-use-ato-fn:pwnginx/client/functions.c:161"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"python/Phyton Shell.py","line":81,"fingerprint":"python.lang.correctness.use-sys-exit:python/Phyton Shell.py:81"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"python/d00r_py3.py","line":89,"fingerprint":"python.lang.correctness.use-sys-exit:python/d00r_py3.py:89"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"python/pyspy.py","line":477,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:python/pyspy.py:477"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"python/python3/Client.py","line":67,"fingerprint":"python.lang.correctness.use-sys-exit:python/python3/Client.py:67"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"python/python3/Server.py","line":123,"fingerprint":"python.lang.correctness.use-sys-exit:python/python3/Server.py:123"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"python/webllehs.py","line":153,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:python/webllehs.py:153"},{"rule_id":"opengrep/bash.lang.best-practice.iteration-over-ls-output","severity":"medium","message":"Iterating over ls output is fragile. Use globs, e.g. 'dir/*' instead of '$(ls dir)'.","path":"sh/list.sh","line":37,"fingerprint":"bash.lang.best-practice.iteration-over-ls-output:sh/list.sh:37"},{"rule_id":"opengrep/bash.lang.best-practice.useless-cat","severity":"medium","message":"Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file.","path":"sh/up.sh","line":26,"fingerprint":"bash.lang.best-practice.useless-cat:sh/up.sh:26"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"脱裤脚本/mysql/pnbak.js","line":62,"fingerprint":"javascript.lang.best-practice.javascript-alert:脱裤脚本/mysql/pnbak.js:62"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"icmp/run.sh","line":27,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:icmp/run.sh:27"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/list.sh","line":16,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/list.sh:16"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"sh/list.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:sh/list.sh:17"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/list.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/list.sh:17"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/list.sh","line":29,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/list.sh:29"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/list.sh","line":31,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/list.sh:31"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/list.sh","line":35,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/list.sh:35"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/list.sh","line":37,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/list.sh:37"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/list.sh","line":41,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/list.sh:41"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/list.sh","line":43,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/list.sh:43"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/up.sh","line":24,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/up.sh:24"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/up.sh","line":28,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/up.sh:28"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/up.sh","line":30,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/up.sh:30"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/up.sh","line":35,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/up.sh:35"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"sh/up.sh","line":36,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:sh/up.sh:36"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":180408.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":9.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":42.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":1.0,"escapes_per_kloc":0.172},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}