Easy Project Security & Risk Analysis

The "iprojectweb" plugin, version 1.2.10.4, exhibits a mixed security posture. While it has no recorded historical vulnerabilities, its static analysis reveals several concerning areas. The plugin exposes two AJAX handlers without authentication checks, presenting a significant risk of unauthorized access and potential manipulation of plugin functionality. Furthermore, the heavy reliance on raw SQL queries (only 15% prepared) and a very low percentage of properly escaped output (5%) indicate a high likelihood of SQL injection and Cross-Site Scripting (XSS) vulnerabilities. The use of the `create_function` function is a direct code quality concern that can lead to security issues. Although taint analysis did not reveal critical or high severity issues, the presence of unsanitized paths is a red flag that warrants further investigation. Overall, despite the absence of known CVEs, the static analysis highlights substantial inherent risks that need to be addressed.