SecWiki/CMS-Hunter

CMS漏洞测试用例集合

https://github.com/SecWiki/CMS-Hunter · commit 5ad0da9524b3 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/SecWiki/CMS-Hunter
Commit: 5ad0da9524b385045e7a4a627d2bb52906badfc5
Generated: 2026-11-13T23:37:07+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	65%	100%
Code quality	40	poor	90%	100%
Security	70	weak	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%

Month	Lines added	Attributed to AI
2017-06	91	0%
2017-07	55	0%
2018-06	158	0%
2018-07	38	0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.01, no CI test run detected; 33% of function code in complex or long functions; 30% duplicated lines. Weakest area: duplication.

Area	Score
Complexity (lizard)	37
Duplication	17
Code smells (Opengrep)	86
Tests and CI	20
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 2,074; mean complexity 4.6, 90th percentile 11; 110 complex and 24 long functions
Duplicated lines: 29.6% of 52,830 compared
Tests: 688 test lines for 75,369 source lines (ratio 0.01); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 94 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	67
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Severity	Finding	Location
high	`opengrep/php.lang.security.phpinfo-use`: The 'phpinfo' function may reveal sensitive information about your environment. [confidence medium]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/Application/Runtime/Cache/Home/p.php:3
high	`opengrep/php.lang.security.eval-use`: Evaluating non-constant commands. This can lead to command injection. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/Application/Runtime/Temp/b068931cc450442b63f5b3d276ea4297.php:3
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Common/functions.php:1169
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Behavior/BrowserCheckBehavior.class.php:19
high	`opengrep/php.lang.security.file-inclusion`: Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead, explicitly specify what to include. If that is not a viable solution, [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Behavior/ChromeShowPageTraceBehavior.class.php:71
high	`opengrep/php.lang.security.file-inclusion`: Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead, explicitly specify what to include. If that is not a viable solution, [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Behavior/CronRunBehavior.class.php:44
high	`opengrep/php.lang.security.file-inclusion`: Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead, explicitly specify what to include. If that is not a viable solution, [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Behavior/FireShowPageTraceBehavior.class.php:67
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Behavior/FireShowPageTraceBehavior.class.php:1121
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Behavior/ParseTemplateBehavior.class.php:28
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Behavior/ParseTemplateBehavior.class.php:60
high	`opengrep/php.lang.security.file-inclusion`: Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead, explicitly specify what to include. If that is not a viable solution, [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Behavior/ShowPageTraceBehavior.class.php:52
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Behavior/TokenBuildBehavior.class.php:43
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Org/Util/Rbac.class.php:162
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Org/Util/String.class.php:20
high	`opengrep/php.lang.security.eval-use`: Evaluating non-constant commands. This can lead to command injection. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Auth.class.php:203
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Cache/Driver/Db.class.php:91
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Cache/Driver/File.class.php:54
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Cache/Driver/File.class.php:132
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Cache/Driver/Shmop.class.php:167
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Crypt/Driver/Base64.class.php:26
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Crypt/Driver/Base64.class.php:50
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Crypt/Driver/Crypt.class.php:30
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Crypt/Driver/Crypt.class.php:71
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Crypt/Driver/Think.class.php:26
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	ThinkPHP/ThinkPHP_3.2.3-5.0.10_缓存函数设计缺陷/tp3.2.3/ThinkPHP/Library/Think/Crypt/Driver/Think.class.php:52

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 75,369; test lines: 688

Language	Lines
PHP	75,047
Python	667
C	343

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/SecWiki/CMS-Hunter/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/SecWiki/CMS-Hunter/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/SecWiki/CMS-Hunter/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/SecWiki/CMS-Hunter/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/SecWiki/CMS-Hunter/security.svg)](https://repotrust.synapticcyber.com/r/github.com/SecWiki/CMS-Hunter/)