Tag: injection
extract() Security Risk PHP 4.0+
extract() creates variables from an array in the current scope — using it on user input ($_POST, $_GET) allows attackers to overwrite any local variable.
2mo ago
security intermediate
Email Header Injection PHP 5.0+
Injecting extra headers or recipients into mail() calls via unvalidated user input, enabling spam relay and phishing.
CWE-93 OWASP A3:2021
2mo ago
security intermediate
6.5
escapeshellarg() PHP 5.0+
Wraps a string in single quotes and escapes internal quotes for safe use as a single shell argument.
2mo ago
php intermediate
Eval Injection PHP 5.0+
User input passed to eval() executes as PHP code, giving attackers full server-side code execution.
CWE-95 OWASP A3:2021
2mo ago
security intermediate
9.8