class	location	match
cmd_exec	./cactid.php		exec('pgrep -a php | grep cactid.php', $output);
cmd_exec	./cli/audit_database.php								exec('php ' . CACTI_PATH_PLUGINS . '/' . $pname . '/database_upgrade.php --type=large --force-ver=' . $old, $output, $return_var);
cmd_exec	./cli/audit_database.php				$db_shell = trim((string) shell_exec('which mysql'));
cmd_exec	./cli/audit_database.php				exec($cmd, $output, $error);
cmd_exec	./cli/audit_database.php		exec('php ' . CACTI_PATH_CLI . '/upgrade_database.php --debug', $output, $return_var);
cmd_exec	./cli/batchgapfix.php			exec($command, $output, $return_var);
cmd_exec	./cli/float_rrdfiles.php					$response = exec($command, $output, $return);
cmd_exec	./cli/float_rrdfiles.php				$response = exec($command, $output, $return);
cmd_exec	./cli/push_out_hosts.php		passthru($php_binary . ' ' . CACTI_PATH_CLI . '/rebuild_poller_cache.php ' . $parameters);
cmd_exec	./cli/remove_broken_graphs.php		$stty  = shell_exec('stty size');
cmd_exec	./cli/rrdresize.php		$process = proc_open($path_rrdtool . ' -', $fds, $pipes);
cmd_exec	./cli/splice_rrd.php		$result      = exec($command, $output, $return_var);
cmd_exec	./cli/splice_rrd.php	$response = shell_exec(cacti_escapeshellcmd($rrdtool));
cmd_exec	./cli/splice_rrd.php	shell_exec(cacti_escapeshellcmd($rrdtool) . ' dump ' . cacti_escapeshellarg($newrrd) . ' > ' . cacti_escapeshellarg($newxmlfile));
cmd_exec	./cli/splice_rrd.php	shell_exec(cacti_escapeshellcmd($rrdtool) . ' dump ' . cacti_escapeshellarg($oldrrd) . ' > ' . cacti_escapeshellarg($oldxmlfile));
cmd_exec	./cli/update_heartbeat.php				$result = exec($command, $output, $return_code);
cmd_exec	./cmd.php			$cactiphp = proc_open($command, $cactides, $pipes);
cmd_exec	./cmd_realtime.php				$cactiphp = proc_open(read_config_option('path_php_binary') . ' -q ' . CACTI_PATH_BASE . '/script_server.php realtime ' . cacti_escapeshellarg($poller_id), $cactides, $pipes);
cmd_exec	./graph_realtime.php			shell_exec($php_binary . ' -q ' . $script_path . ' ' . $args);
cmd_exec	./host.php		shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/poller_reindex_hosts.php') . ' --qid=all --id=' . $host_id);
cmd_exec	./install/functions.php				$shell_output       = shell_exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_CLI . '/import_package.php') . ' --filename=' . cacti_escapeshellarg("/$path/$xmlfile") . ' --info');
cmd_exec	./install/install.php			print '<li>' . __('The shell_exec() and/or exec() functions are currently blocked.') . '<br>' . __('See the PHP Manual: <a href="http://php.net/manual/en/ini.core.php#ini.disable-functions">Disable Functions</a>.') . '</li>';
cmd_exec	./lib/database.php				exec("$dump_esc $options $credentials_string " . cacti_escapeshellarg($database) . ($tables_esc !== '' ? ' ' . $tables_esc : '') . " > $output_esc", $output, $retval);
cmd_exec	./lib/database.php				exec("$dump_esc $options $credentials_string --user=" . cacti_escapeshellarg($username) . ' --password=' . cacti_escapeshellarg($password) . ' ' . cacti_escapeshellarg($database) . ($tables_esc !== '' ? ' ' . $tables_esc : '') . " > $output_esc", $output, $retval);
cmd_exec	./lib/database.php			exec("$dump_esc $options $credentials_string " . cacti_escapeshellarg($database) . ' version >/dev/null 2>&1', $output, $retval);
cmd_exec	./lib/database.php			exec("$dump_esc $options $credentials_string " . cacti_escapeshellarg($database) . ($tables_esc !== '' ? ' ' . $tables_esc : '') . " > $output_esc", $output, $retval);
cmd_exec	./lib/dsstats.php		$process = proc_open($command, $fds, $pipes);
cmd_exec	./lib/functions.php							$output = shell_exec($script_path);
cmd_exec	./lib/functions.php						$output = shell_exec("$php -q $script");
cmd_exec	./lib/functions.php					$output = shell_exec($script_path);
cmd_exec	./lib/functions.php					$shell = shell_exec(cacti_escapeshellcmd(read_config_option('path_rrdtool')) . ' -v 2>&1');
cmd_exec	./lib/functions.php					$shell = shell_exec(cacti_escapeshellcmd(read_config_option('path_rrdtool')) . ' -v');
cmd_exec	./lib/functions.php					shell_exec($killCmd);
cmd_exec	./lib/functions.php				$cpu_cores = shell_exec('/bin/nproc');
cmd_exec	./lib/functions.php				$cpu_cores = shell_exec('/usr/bin/nproc');
cmd_exec	./lib/functions.php				$output = shell_exec('nproc');
cmd_exec	./lib/functions.php				exec('id -nu', $o, $r);
cmd_exec	./lib/functions.php			$cpu_cores = shell_exec('sysctl -n hw.ncpu');
cmd_exec	./lib/functions.php			$output = shell_exec('powershell -Command "Get-WmiObject Win32_Processor | Select-Object NumberOfLogicalProcessors"');
cmd_exec	./lib/functions.php			$processExists   = trim((string) shell_exec($checkProcessCmd));
cmd_exec	./lib/functions.php		exec($command_line, $out, $return_code);
cmd_exec	./lib/functions.php		return exec('whoami') ?: '';
cmd_exec	./lib/functions.php	 * On Windows, exec()/shell_exec()/popen() route through cmd.exe, which ignores
cmd_exec	./lib/installer.php						$output = shell_exec(
cmd_exec	./lib/installer.php						$output = shell_exec(cacti_escapeshellcmd(str_replace('\\', '/', $path)) . ' --version 2>&1');
cmd_exec	./lib/installer.php			$check    = shell_exec("$composer install --dry-run --no-interaction --working-dir=$base 2>&1");
cmd_exec	./lib/installer.php			$output = shell_exec("$composer install --no-interaction --no-progress --working-dir=$base 2>&1");
cmd_exec	./lib/installer.php			$process = proc_open(
cmd_exec	./lib/ping.php							$result = shell_exec('ping -6 -W ' . ceil($this->timeout / 1000) . ' -c ' . $this->retries . ' -p ' . $pattern . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php							$result = shell_exec('ping -W ' . ceil($this->timeout / 1000) . ' -c ' . $this->retries . ' -p ' . $pattern . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true) . ' 2>&1');
cmd_exec	./lib/ping.php							$result = shell_exec('ping -t ' . ceil($this->timeout / 1000) . ' -c ' . $this->retries . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php							$result = shell_exec('ping6 -t ' . ceil($this->timeout / 1000) . ' -c ' . $this->retries . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php						$result = shell_exec('chcp 437 && ping -w ' . $this->timeout . ' -n ' . $this->retries . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php						$result = shell_exec('ping ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php						$result = shell_exec('ping -i ' . ceil($this->timeout / 1000) . ' -c ' . $this->retries . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php						$result = shell_exec('ping -m ' . ceil($this->timeout / 1000) . ' -n ' . $this->retries . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php						$result = shell_exec('ping -t ' . ceil($this->timeout / 1000) . ' -c ' . $this->retries . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php						$result = shell_exec('ping -t ' . ceil($this->timeout / 1000) . ' -c ' . $this->retries . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php						$result = shell_exec('ping -w ' . ceil($this->timeout / 1000) . ' -c ' . $this->retries . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true));
cmd_exec	./lib/ping.php					$result = shell_exec(cacti_escapeshellarg($fping) . ' -q -t ' . $this->timeout . ' -c 1 -r ' . $this->retries . ' ' . cacti_escapeshellarg_cmd($this->host['hostname'], true, true) . ' 2>&1');
cmd_exec	./lib/poller.php										$output = system($php_path . ' -l ' . $tmpfile, $exit);
cmd_exec	./lib/poller.php						pclose(popen('start "Cactiplus" /I ' . $filename . ' ' . $args . ' ' . $redirect_args, 'r'));
cmd_exec	./lib/poller.php						pclose(popen('start "Cactiplus" /I ' . $filename . ' ' . $args, 'r'));
cmd_exec	./lib/poller.php					$fp = popen($command, 'r');
cmd_exec	./lib/poller.php					$fp = popen($command, 'rb');
cmd_exec	./lib/poller.php					exec($safe_filename . ' ' . $args . ' ' . $redirect_args . ' &');
cmd_exec	./lib/poller.php					exec($safe_filename . ' ' . $args . ' > /dev/null 2>&1 &');
cmd_exec	./lib/poller.php				$output = shell_exec($command);
cmd_exec	./lib/poller.php			$setsid_path = trim((string) shell_exec('which setsid 2>/dev/null'));
cmd_exec	./lib/poller.php		$process = @proc_open($command, $descriptors, $pipes, null, null, ['bypass_shell' => true]);
cmd_exec	./lib/poller.php		$process = proc_open('exec ' . $cmd_full, $descriptors, $pipes);
cmd_exec	./lib/poller.php	 *                                    of the proc_open() and proc_close() functions (php 4.3+)
cmd_exec	./lib/poller.php	 * @param array  $pipes               The array of r/w pipes returned from proc_open()
cmd_exec	./lib/poller.php	 * @param mixed  $proc_fd             The file descriptor returned from proc_open()
cmd_exec	./lib/rrd.php			$process = proc_open([$path, '-'], $descriptors, $pipes, null, null, ['bypass_shell' => true]);
cmd_exec	./lib/rrdcheck.php		$process = proc_open($command, $fds, $pipes);
cmd_exec	./lib/snmp.php			// exec() does not capture, so the walk output can never contain either.
cmd_exec	./lib/snmp.php			exec($command, $snmp_value, $return_var);
cmd_exec	./lib/snmp.php			exec($command, $snmp_value, $return_var);
cmd_exec	./lib/snmp.php			exec($command, $snmp_value, $return_var);
cmd_exec	./lib/snmpagent.php		// add pollers of a distributed system (future)
cmd_exec	./lib/spikekill.php			$dump_output = shell_exec(cacti_escapeshellcmd(read_config_option('path_rrdtool')) . ' dump ' . cacti_escapeshellarg($this->rrdfile) . ' 2>&1 > ' . cacti_escapeshellarg($xmlfile));
cmd_exec	./lib/spikekill.php			$response = shell_exec(cacti_escapeshellcmd(read_config_option('path_rrdtool')) . ' restore -f -r ' . cacti_escapeshellarg($xmlfile) . ' ' . cacti_escapeshellarg($rrdfile));
cmd_exec	./lib/utility.php							$nproc = system('nproc');
cmd_exec	./lib/utility.php				exec('/usr/bin/free', $output, $exit_code);
cmd_exec	./lib/utility.php			exec('wmic os get FreePhysicalMemory', $memInfo['FreePhysicalMemory']);
cmd_exec	./lib/utility.php			exec('wmic os get FreeSpaceInPagingFiles', $memInfo['FreeSpaceInPagingFiles']);
cmd_exec	./lib/utility.php			exec('wmic os get FreeVirtualMemory', $memInfo['FreeVirtualMemory']);
cmd_exec	./lib/utility.php			exec('wmic os get SizeStoredInPagingFiles', $memInfo['SizeStoredInPagingFiles']);
cmd_exec	./lib/utility.php			exec('wmic os get TotalVirtualMemorySize', $memInfo['TotalVirtualMemorySize']);
cmd_exec	./lib/utility.php			exec('wmic os get TotalVisibleMemorySize', $memInfo['TotalVisibleMemorySize']);
cmd_exec	./lib/utility.php		$json       = shell_exec($php . ' -q ' . $php_file);
cmd_exec	./lib/utility.php		$json     = shell_exec($php . ' -q ' . $php_file);
cmd_exec	./lib/utility.php		$json     = shell_exec($php . ' -q ' . $php_file);
cmd_exec	./poller_realtime.php	shell_exec("$command_string $extra_args");
cmd_exec	./poller_spikekill.php				$response = exec(cacti_escapeshellcmd((string) read_config_option('path_php_binary')) . ' -q ' .
cmd_exec	./remote_agent.php									$cactiphp = proc_open(read_config_option('path_php_binary') . ' -q ' . CACTI_PATH_BASE . '/script_server.php realtime ' . cacti_escapeshellarg($poller_id), $cactides, $pipes);
cmd_exec	./script_server.php					exec("TASKLIST /FO LIST /FI \"PID eq $ppid\"", $out);
cmd_exec	./scripts/sql.php	$sql = shell_exec($cmd);
cmd_exec	./scripts/ss_netsnmp_lmsensors.php			$virtual = intval(shell_exec('/usr/bin/hostnamectl 2> /dev/null | grep -i virtual | wc -l'));
cmd_exec	./scripts/ss_sql.php		$result = shell_exec($cmd) ?? '';
cmd_exec	./snmpagent_mibcache.php			exec($php . ' ' . $extra_args . ' > /dev/null &');
cmd_exec	./snmpagent_mibcache.php			popen('start "CactiSNMPCacheChild" /I ' . $php . ' ' . $extra_args, 'r');
cmd_exec	./snmpagent_persist.php			exec($php . ' ' . $extra_args . ' > /dev/null &');
cmd_exec	./snmpagent_persist.php		exec('ps -ef | grep -v grep | grep -v "sh -c" | grep snmpagent_mibcache.php', $output);
cmd_exec	./snmpagent_persist.php		pclose(popen('start "CactiSNMPCache" /I /B ' . $php . ' ' . $extra_args, 'r'));
cmd_exec	./support.php					$out     = shell_exec(cacti_escapeshellarg($path) . ' ' . $arg . ' 2>&1');
cmd_exec	./support.php					print '<td>' . tech_env_status(DB_STATUS_WARNING, __('Version unavailable: shell_exec() is disabled')) . '</td>';
cmd_exec	./support.php				exec(cacti_escapeshellcmd(read_config_option('path_rrdtool')), $out_array);
cmd_exec	./support.php			$cli_json = shell_exec(cacti_escapeshellcmd($php_binary) . ' -q ' . cacti_escapeshellarg(CACTI_PATH_INSTALL . '/cli_check.php') . ' extensions');
cmd_exec	./support.php			$snmp_version   = (string) shell_exec(cacti_escapeshellcmd($snmpget_path) . ' -V 2>&1');
cmd_exec	./support.php			exec(cacti_escapeshellcmd(read_config_option('path_spine')) . ' --version', $out_array);
dynamic_include	./cli/audit_database.php								require_once($plugin . '/includes/database.php');
dynamic_include	./cli/audit_database.php							require_once($plugin . '/setup.php');
dynamic_include	./cli/upgrade_database.php			include($upgrade_file);
dynamic_include	./include/global.php		require_once($vendor_autoload);
dynamic_include	./include/global_languages.php				require_once($providerFull);
dynamic_include	./index.php							require_once($file);
dynamic_include	./lib/installer.php					include_once($upgrade_file);
dynamic_include	./lib/plugins.php						include_once($full_path);
dynamic_include	./lib/plugins.php			require_once($setup_file);
dynamic_include	./lib/renderer.php				include $__cacti_template_file;
dynamic_include	./lib/rrd.php			include($rrdtheme);
dynamic_include	./lib/rrd.php			include($themefile);
dynamic_include	./link.php					require_once($file);
dynamic_include	./plugins.php				require_once($setup_file);
dynamic_include	./reports.php		require_once($reportit_api);
dynamic_include	./script_server.php						require_once($include_file);
dynamic_include	./scripts/ss_mikrotik_snmpget.php		include_once($config['base_path'] . '/lib/snmp.php');
dynamic_include	./scripts/ss_netsnmp_lmsensors.php		include($config['base_path'] . '/lib/snmp.php');
dynamic_include	./snmpagent_persist.php				require($path_mibcache);
host_header	./lib/auth.php				$result['link']   = \Sonata\GoogleAuthenticator\GoogleQrUrl::generate($current_user['username'] . '@' . $_SERVER['HTTP_HOST'], $current_user['tfa_secret'], 'Cacti');