Tag: security
NoSQL Injection
PHP 5.4+
2
Attacker-controlled input embedded into NoSQL queries (MongoDB, Redis, Couchbase) that subverts query intent — bypassing auth, exfiltrating data, or executing server-side code.
CWE-943 OWASP A3:2021
1mo ago
security intermediate
8.8
Null Byte in File Paths (Legacy PHP)
PHP 3.0+
Null bytes (%00) in file paths truncated strings at the C level in PHP < 5.3.4 — PHP 5.3.4+ throws a warning, PHP 7 throws ValueError for NUL in paths.
2mo ago
security advanced