All pull requests

Pull requests

• Remove hardcoded database credentials

  #305·r0path opened Mar 26, 2026Owner·

  ·
  6

• Update upload.php

  #294·hugbubby opened Feb 2, 2026Collaborator·

  ·
  5

• Mitigate RCE in xss.php: validate and safely execute cmd via whitelist and escaping

  #293·zeropath-ai[bot] opened Jan 16, 2026Bot·

  ·

• Encode echoed user input with htmlspecialchars to prevent reflected XSS in xss.php

  #292·zeropath-ai[bot] opened Jan 16, 2026Bot·

  ·

• Disable unsafe system() execution in asdas3d.php to prevent RCE

  #291·zeropath-ai-staging[bot] opened Jan 15, 2026Bot·

  ·

• R0path patch 20 test

  #290·r0path opened Dec 4, 2025Owner·

  ·
  4

• Create basicrce.php

  #284·r0path opened Aug 29, 2025Owner·

  ·
  4

• Create test123.php

  #283·r0path opened Aug 28, 2025Owner·

  ·
  3

• Create aasdasda.php

  #282·r0path opened Aug 28, 2025Owner·

  ·
  5

• Create upload1.php

  #280·r0path opened Aug 28, 2025Owner·

  ·
  2

• Create xss.php

  #275·r0path opened Aug 5, 2025Owner·

  ·
  3

• Remote code execution via Flask debug mode enabled - High

  #274·zeropath-ai-dev[bot] opened Jul 25, 2025Bot·

  ·
  8

• Update main.py

  #273·hugbubby opened Jul 14, 2025Collaborator·

  ·

• Remote Code Execution via /login endpoint - Critical

  #272·zeropath-ai-dev[bot] opened Jul 11, 2025Bot·

  ·

• Create .env

  #271·rek7 opened Jul 10, 2025Collaborator·

  ·
  1

• Remote Code Execution via eval() on user input - Critical

  #270·zeropath-ai-dev[bot] opened Jul 10, 2025Bot·

  ·

• Create test2.py

  #269·rek7 opened Jul 10, 2025Collaborator·

  ·
  2

• Create test.py (secret detection not internet connected validation test)

  #268·rek7 opened Jul 10, 2025Collaborator·

  ·
  2

• Shell Injection via os.system() in get_user() - Critical

  #264·zeropath-ai-dev[bot] opened Jul 8, 2025Bot·

  ·

• Fix access control vulnerability in get_note endpoint by restricting note access to the authenticated user only.

  #237·zeropath-ai-dev[bot] opened Jun 26, 2025Bot·

  ·

• Fix command injection in login handler by removing insecure os.system(password) call

  #236·zeropath-ai-dev[bot] opened Jun 26, 2025Bot·

  ·

• Fix XSS vulnerability by sanitizing 'search' GET parameter with htmlspecialchars in index.php

  #225·zeropath-ai-dev[bot] opened Jun 24, 2025Bot·

  ·

• Fix OS Command Injection by removing unsafe execution of user-controlled 'username' input.

  #215·zeropath-ai-dev[bot] opened Jun 17, 2025Bot·

  ·
  5

• Fix OS Command Injection vulnerability by removing insecure os.system() call with unsanitized user input.

  #214·zeropath-ai-dev[bot] opened Jun 12, 2025Bot·

  ·
  4

• Add endpoint comments to the login function to document authentication behavior and response codes.

  #206·zeropath-ai-dev[bot] opened Jun 6, 2025Bot·

  ·