Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

AndrewPaglusch/FlashPaper

              master @ 5ff41cb
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Cryptographic Weakness: 1 prior fix. Scrutinize any change in this area.

includes/functions.php: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: User-controlled template filename directly used in file read without sanitization allowed directory traversal; fixed by basename() but sibling paths may still be exposed.

Reflected XSS: User-controlled 'k' parameter echoed without encoding, enabling script injection; fixed by htmlspecialchars() but other echo sites may lack encoding.

Cryptographic Weakness: Static salt in password_hash made secret hashes predictable and crackable; fixed by random per-secret salt and SQLite storage, but legacy hashes or other hashing paths may remain.