SharpLaunch Property Search Engine Security & Risk Analysis

The "sharplaunch-property-search-engine" v3.1.2 plugin exhibits a mixed security posture. While the static analysis shows a low number of entry points and no recorded CVEs, there are areas of concern. Specifically, the presence of a REST API route without permission callbacks is a significant risk, as it creates an unprotected entry point that could be exploited by unauthenticated users. The complete lack of prepared statements for SQL queries is also a major red flag, suggesting a high likelihood of SQL injection vulnerabilities. Although no taint flows were identified, this could be due to the limited scope of the analysis or the absence of specific test cases that trigger such flows. The plugin's vulnerability history is clean, which is positive, but the static code signals present real and immediate risks that need attention. Overall, the plugin has strengths in its limited attack surface and lack of known vulnerabilities, but weaknesses in its SQL handling and unprotected REST API route pose significant security risks.