cubicFUSION Admin Enhancer Security & Risk Analysis

The 'cubicfusion-admin-enhancer' plugin version 0.6.0.0 exhibits a mixed security posture. While it has a clean vulnerability history with no known CVEs, the static analysis reveals several areas of concern. The presence of 67 dangerous function calls, including `unserialize` and `assert`, warrants careful consideration. Additionally, the plugin's attack surface includes four AJAX handlers, with one lacking authentication checks, presenting a potential entry point for unauthorized actions. The static analysis also found a single SQL query that is not using prepared statements, which could be susceptible to SQL injection if not handled carefully by the application context. Taint analysis did not reveal critical or high-severity vulnerabilities, but it did identify one flow with an unsanitized path, indicating a potential weakness in data handling. The plugin demonstrates a good number of capability checks and output escaping, suggesting some attention to secure coding practices.