https://github.com/wordpress/wordpress ·
lang: php ·
LOC: ·
source: user_submitted
| Rule | Severity | Count |
|---|---|---|
AIC003 Duplicated implementation block across source files |
low | 30 |
MINED123 Trojan Source bidi character in source (CVE-2021-42574) |
critical | 5 |
AIC002 Source file name looks like an AI patch artifact |
low | 5 |
MINED048 Php Error Suppress |
info | 4 |
ERR002 [ERR002] Empty Catch Block: Empty catch blocks hide errors. |
medium | 4 |
SEC085 JS: child_process.exec with non-literal |
high | 4 |
MINED044 Js Console Log Prod |
info | 4 |
SEC045 eval()/exec() on stored or user-supplied data |
medium | 4 |
SEC132 String concat where the language has interpolation (AI styl… |
low | 4 |
MINED053 Placeholder Default Username |
info | 4 |
MINED024
Js Eval Usage
CWE-95
wp-includes/js/tw-sack.js:119
· conf 1.00
[MINED024] Js Eval Usage: eval() executes arbitrary code. Code injection risk.MINED035
Js New Function
CWE-95
wp-includes/js/codemirror/fakejshint.js:14
· conf 1.00
[MINED035] Js New Function: new Function(...) compiles strings to functions.MINED123
Trojan Source bidi character in source (CVE-2021-42574)
CWE-1007
wp-includes/html-api/html5-named-character-references.php:896
· conf 0.90
[MINED123] Trojan Source bidi character (LRM) in source: Line 896 contains a Unicode bidirectional override character (U+200E LRM). This is the 'Trojan Source' attack (CVE-2021-42574): the character …MINED123
Trojan Source bidi character in source (CVE-2021-42574)
CWE-1007
wp-includes/html-api/html5-named-character-references.php:897
· conf 0.90
[MINED123] Trojan Source bidi character (LRM) in source: Line 897 contains a Unicode bidirectional override character (U+200E LRM). This is the 'Trojan Source' attack (CVE-2021-42574): the character …MINED123
Trojan Source bidi character in source (CVE-2021-42574)
CWE-1007
wp-includes/html-api/html5-named-character-references.php:1076
· conf 0.90
[MINED123] Trojan Source bidi character (RLM) in source: Line 1076 contains a Unicode bidirectional override character (U+200F RLM). This is the 'Trojan Source' attack (CVE-2021-42574): the character…MINED123
Trojan Source bidi character in source (CVE-2021-42574)
CWE-1007
wp-includes/html-api/html5-named-character-references.php:1077
· conf 0.90
[MINED123] Trojan Source bidi character (RLM) in source: Line 1077 contains a Unicode bidirectional override character (U+200F RLM). This is the 'Trojan Source' attack (CVE-2021-42574): the character…MINED123
Trojan Source bidi character in source (CVE-2021-42574)
CWE-1007
wp-includes/js/codemirror/espree.min.js:1
· conf 0.90
[MINED123] Trojan Source bidi character (LRM) in source: Line 1 contains a Unicode bidirectional override character (U+200E LRM). This is the 'Trojan Source' attack (CVE-2021-42574): the character ma…SEC001
Hardcoded Password
wp-admin/js/auth-app.js:84
· conf 0.45
[SEC001] Hardcoded Password: Hardcoded password found in source code.CORE_NO_TESTS
No test files found
No test files foundMINED004
Weak Crypto
CWE-327
wp-admin/includes/import.php:140
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED004
Weak Crypto
CWE-327
wp-includes/SimplePie/src/Author.php:64
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED004
Weak Crypto
CWE-327
wp-includes/SimplePie/src/Cache/Memcache.php:66
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).SEC013
Path Traversal — User Input in File Path
wp-includes/js/tw-sack.js:136
· conf 0.80
[SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.SEC027
XML External Entity (XXE) — Node.js xml parsers
wp-includes/js/wp-sanitize.js:30
· conf 1.00
[SEC027] XML External Entity (XXE) — Node.js xml parsers: Node.js XML parsers can expand external entities if not configured. libxmljs in particular has had XXE CVEs.SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
wp-activate.php:128
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
wp-admin/admin-footer.php:38
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
wp-admin/async-upload.php:68
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC083
JS: new RegExp() with non-literal
wp-admin/js/tags-box.js:65
· conf 1.00
[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).SEC083
JS: new RegExp() with non-literal
wp-admin/js/tags-suggest.js:14
· conf 1.00
[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).SEC083
JS: new RegExp() with non-literal
wp-includes/js/jquery/suggest.js:212
· conf 1.00
[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0).SEC085
JS: child_process.exec with non-literal
wp-content/themes/twentytwentyone/assets/js/customize-helpers.js:33
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC085
JS: child_process.exec with non-literal
wp-includes/js/jquery/ui/effect-fold.js:43
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC085
JS: child_process.exec with non-literal
wp-includes/js/shortcode.js:30
· conf 1.00
[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).SEC128
Async function without await — fire-and-forget Promise (AI mistake)
wp-includes/js/customize-loader.js:247
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
wp-includes/js/customize-views.js:113
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
wp-includes/js/wp-pointer.js:108
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…AIC008
Vendored upstream framework tree is mixed with application code
wp-admin:1
· conf 0.82
Vendored upstream framework tree is mixed with application codeAIC008
Vendored upstream framework tree is mixed with application code
wp-includes:1
· conf 0.82
Vendored upstream framework tree is mixed with application codeCFG006
[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.
[CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.CORE_NO_CI
No CI/CD configuration found
No CI/CD configuration foundERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
wp-admin/js/media-upload.js:61
· conf 0.45
[ERR002] Empty Catch Block: Empty catch blocks hide errors.ERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
wp-admin/js/privacy-tools.js:323
· conf 0.45
[ERR002] Empty Catch Block: Empty catch blocks hide errors.ERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
wp-admin/js/svg-painter.js:104
· conf 0.45
[ERR002] Empty Catch Block: Empty catch blocks hide errors.SEC001
Hardcoded Password
wp-admin/network/site-new.php:111
· conf 0.30
[SEC001] Hardcoded Password: Hardcoded password found in source code.SEC015
Insecure Randomness for Security
wp-includes/js/wp-embed.js:99
· conf 0.45
[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
wp-includes/blocks/navigation-submenu.php:194
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
wp-includes/widgets/class-wp-widget-media-video.php:261
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC045
eval()/exec() on stored or user-supplied data
wp-content/themes/twentytwentyone/assets/js/customize-helpers.js:33
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
wp-includes/js/codemirror/fakejshint.js:14
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC045
eval()/exec() on stored or user-supplied data
wp-includes/js/jquery/ui/effect-fold.js:43
· conf 1.00
[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even admin-stored data — is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ …SEC046
Client-side open redirect — window.location = server-supplied URL
wp-admin/js/privacy-tools.js:91
· conf 1.00
[SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning window.location from a server-supplied URL trusts the server endpoint to never return a hostile destination. If t…SEC046
Client-side open redirect — window.location = server-supplied URL
wp-includes/js/wp-embed.js:82
· conf 1.00
[SEC046] Client-side open redirect — window.location = server-supplied URL: Assigning window.location from a server-supplied URL trusts the server endpoint to never return a hostile destination. If t…SEC087
JS: weak Math.random for crypto
wp-includes/js/wp-embed.js:99
· conf 1.00
[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes conce…SEC134
AI scaffold leftover — Lorem ipsum / example.com / John Doe in code
wp-content/themes/twentyeleven/inc/block-patterns.php:125
· conf 1.00
[SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't…AIC002
Source file name looks like an AI patch artifact
wp-content/themes/twentyfifteen/js/skip-link-focus-fix.js:1
· conf 0.62
Source file name looks like an AI patch artifactAIC002
Source file name looks like an AI patch artifact
wp-content/themes/twentynineteen/js/skip-link-focus-fix.js:1
· conf 0.62
Source file name looks like an AI patch artifactAIC002
Source file name looks like an AI patch artifact
wp-content/themes/twentyseventeen/assets/js/skip-link-focus-fix.js:1
· conf 0.62
Source file name looks like an AI patch artifactAIC002
Source file name looks like an AI patch artifact
wp-content/themes/twentysixteen/js/skip-link-focus-fix.js:1
· conf 0.62
Source file name looks like an AI patch artifactAIC002
Source file name looks like an AI patch artifact
wp-content/themes/twentytwenty/assets/js/skip-link-focus-fix.js:1
· conf 0.62
Source file name looks like an AI patch artifactAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/author.php:40
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/category.php:18
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/content-link.php:8
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/content.php:18
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/content.php:31
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/content-quote.php:12
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/content-quote.php:25
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/content-single.php:11
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/content-status.php:8
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/index.php:12
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/search.php:10
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/sidebar-page.php:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/tag.php:16
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyeleven/tag.php:18
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfifteen/content.php:16
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfifteen/content.php:24
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfifteen/image.php:32
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfifteen/inc/customizer.php:464
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfifteen/index.php:11
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfifteen/search.php:19
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfourteen/author.php:19
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfourteen/category.php:19
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfourteen/content-audio.php:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfourteen/content-gallery.php:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfourteen/content-image.php:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyfourteen/content-link.php:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentynineteen/js/skip-link-focus-fix.js:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentyseventeen/assets/js/skip-link-focus-fix.js:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentysixteen/js/skip-link-focus-fix.js:1
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
wp-content/themes/twentytwenty/assets/js/skip-link-focus-fix.js:1
· conf 0.86
Duplicated implementation block across source filesSEC006
XSS Risk
wp-admin/js/password-toggle.js:28
· conf 0.40
[SEC006] XSS Risk: Direct HTML injection without sanitization.SEC006
XSS Risk
wp-includes/js/tw-sack.js:172
· conf 0.40
[SEC006] XSS Risk: Direct HTML injection without sanitization.SEC006
XSS Risk
wp-includes/js/wp-custom-header.js:124
· conf 0.40
[SEC006] XSS Risk: Direct HTML injection without sanitization.SEC132
String concat where the language has interpolation (AI style drift)
wp-admin/js/application-passwords.js:50
· conf 1.00
[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…SEC132
String concat where the language has interpolation (AI style drift)
wp-admin/js/link.js:82
· conf 1.00
[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…SEC132
String concat where the language has interpolation (AI style drift)
wp-admin/js/media-gallery.js:23
· conf 1.00
[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…ERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
[ERR002] Empty Catch Block (and 4 more): Same pattern found in 4 additional files. Review if needed.MINED004
Weak Crypto
CWE-327
[MINED004] Weak Crypto (and 16 more): Same pattern found in 16 additional files. Review if needed.MINED043
Http Not Https
CWE-319
[MINED043] Http Not Https (and 15 more): Same pattern found in 15 additional files. Review if needed.MINED043
Http Not Https
CWE-319
wp-activate.php:159
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
wp-admin/includes/class-wp-importer.php:151
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
wp-admin/includes/credits.php:35
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED044
Js Console Log Prod
CWE-532
[MINED044] Js Console Log Prod (and 1 more): Same pattern found in 1 additional files. Review if needed.MINED044
Js Console Log Prod
CWE-532
wp-admin/js/password-strength-meter.js:63
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
wp-includes/js/mediaelement/mediaelement-migrate.js:78
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
wp-includes/js/tinymce/plugins/compat3x/plugin.js:31
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED048
Php Error Suppress
CWE-755
[MINED048] Php Error Suppress (and 10 more): Same pattern found in 10 additional files. Review if needed.MINED048
Php Error Suppress
CWE-755
wp-admin/includes/class-file-upload-upgrader.php:153
· conf 1.00
[MINED048] Php Error Suppress: @function() suppresses errors silently. Hides real issues.MINED048
Php Error Suppress
CWE-755
wp-admin/includes/class-ftp-pure.php:39
· conf 1.00
[MINED048] Php Error Suppress: @function() suppresses errors silently. Hides real issues.MINED048
Php Error Suppress
CWE-755
wp-admin/includes/class-ftp-sockets.php:39
· conf 1.00
[MINED048] Php Error Suppress: @function() suppresses errors silently. Hides real issues.MINED053
Placeholder Default Username
CWE-1392CWE-798
[MINED053] Placeholder Default Username (and 43 more): Same pattern found in 43 additional files. Review if needed.MINED053
Placeholder Default Username
CWE-1392CWE-798
wp-admin/async-upload.php:20
· conf 1.00
[MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin / changeme — typical AI placeholder credentials.MINED053
Placeholder Default Username
CWE-1392CWE-798
wp-admin/authorize-application.php:134
· conf 1.00
[MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin / changeme — typical AI placeholder credentials.MINED053
Placeholder Default Username
CWE-1392CWE-798
wp-admin/contribute.php:22
· conf 1.00
[MINED053] Placeholder Default Username: [email protected] / [email protected] / admin/admin / changeme — typical AI placeholder credentials.MINED098
Global Scope Pollution
[MINED098] Global Scope Pollution (and 6 more): Same pattern found in 6 additional files. Review if needed.MINED098
Global Scope Pollution
wp-admin/js/auth-app.js:86
· conf 1.00
[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios = axios;`) makes the code harder to test and increases the risk of naming colli…MINED098
Global Scope Pollution
wp-admin/js/gallery.js:92
· conf 1.00
[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios = axios;`) makes the code harder to test and increases the risk of naming colli…MINED098
Global Scope Pollution
wp-admin/js/privacy-tools.js:91
· conf 1.00
[MINED098] Global Scope Pollution: Attaching libraries/objects directly to the global window scope (e.g., `window.axios = axios;`) makes the code harder to test and increases the risk of naming colli…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 267 more): Same pattern found in 267 additional files. Review if needed.SEC045
eval()/exec() on stored or user-supplied data
[SEC045] eval()/exec() on stored or user-supplied data (and 3 more): Same pattern found in 3 additional files. Review if needed.SEC083
JS: new RegExp() with non-literal
[SEC083] JS: new RegExp() with non-literal (and 3 more): Same pattern found in 3 additional files. Review if needed.SEC085
JS: child_process.exec with non-literal
[SEC085] JS: child_process.exec with non-literal (and 1 more): Same pattern found in 1 additional files. Review if needed.SEC132
String concat where the language has interpolation (AI style drift)
[SEC132] String concat where the language has interpolation (AI style drift) (and 7 more): Same pattern found in 7 additional files. Review if needed.Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/6d531520-742c-4cc2-8f61-486e8f74ff8a/.