// wall of bugs caught
15 critical bugs
PullLight would have caught in your PRs.
Every card below is a real bug flagged during PR review — CVEs, CWEs, before/after code. No competitors have a page like this. Try it on your own PR →
19
Total catches
15
Critical
4
High
15
CVSS ≥ 9
6
Languages
critical
# deserialization
PHP
CVE-2025-49113
PHP Object Deserialization via _from Parameter
Roundcube's mail composition endpoint passes the _from POST parameter to PHP's unserialize() — attacker crafts a POP chain via installed PHP classes to achieve RCE with webserver privileges.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable) $from = unserialize($_POST['_from']); // attacker-controlled! $identity = $from->get_identity();
After (fixed)
// AFTER (fixed)
if (!rcube_utils::is_simple_string($_POST['_from'])) {
throw new Exception('Invalid _from parameter');
}
$from = $_POST['_from'];
critical
# injection
PHP
CVE-2026-33352
SQL Injection via Backslash-Escape Bypass in AVideo
WWBN/AVideo uses str_replace("'", "'") to sanitize SQL input, but this only escapes single quotes, not backslashes. An attacker injects a backslash to break the string context.
Before / after code snippet
Before (vulnerable)
// BEFORE (vulnerable)
// str_replace only handles quotes, not backslashes
$name = str_replace("'", "'", $_POST['name']);
$sql = "SELECT * FROM category WHERE name = '" . $name . "'";
// Attack: name=test\\' OR 1=1 --
After (fixed)
// AFTER (fixed) // Use mysqli->real_escape_string() — handles ALL special chars $name = $global['mysqli']->real_escape_string($_POST['name']); $sql = "SELECT * FROM category WHERE name = '" . $name . "'";