Faithful minimal PoCs reproducing the vulnerable code pattern of real, published CVEs (2023+) across every PHP framework/CMS this analyzer models. Each file is a self-contained reduction of the advisory's source→sink flow — enough to exercise the taint model, not a runnable exploit.

Purpose: a regression + generalization corpus. The same query/model that flags the reduced pattern here finds the class of bug wherever it recurs. Several models/rules were added specifically to catch these patterns (see git history + the ▸ notes below), so they — and their lookalikes elsewhere — now are.

cve/<framework>/CVE-YYYY-NNNNN.php   # header cites the advisory; sink line preceded by `// ruleid: <query>`
cve/run.sh                           # extract cve/ → analyze (php-security-extended) → score
cve/score.py                         # compares SARIF vs. the `// ruleid:` annotations (±1 line)

Run: bash cve/run.sh — reports DETECTED n/N annotated sinks + any un-annotated findings.

Added while building the corpus (all data/model-level or small, generalizable QL — benchmark FP unchanged at 40/176, full test suite green):

• Symfony/Drupal request-bag idiom — a structural source for $request->{query,request,attributes,cookies,files}->{get,all,…}(), the single most common Symfony/Drupal input accessor.
• __construct typed sinks fire on new Class($arg) — new RedirectResponse($url), new SplFileObject($path), … (previously constructor sinks only matched Class::__construct()-style calls).
• Upload-filename sources — getClientName, getClientOriginalName/Extension, getClientFilename (the upload-RCE / traversal class).
• CakePHP Query::limit/offset SQL sinks (the exact CVE-2023-22727 vector); Drupal system_retrieve_file/drupal_http_request SSRF sinks.
• Kind-scoped sanitizers — sanitize_text_field/sanitize_textarea_field are now XSS-only barriers that still carry taint to SQL/path sinks, so the sanitize-then-SQLi class (CVE-2024-1071, CVE-2023-6360) is no longer hidden.
• Soundness: a name-based sanitizer defers to a same-named function defined in the analyzed code — a custom no-op sanitize_text_field is not blindly trusted; its real body is analyzed (regression test ShadowedSanitizer).
• Drupal-7 array form state — a structural source for $form_state['values'/'input'][...]; Joomla getUserStateFromRequest request source.
• Fluent query-builder taint — $q->where($x)/->order($x)/->having($x)/… taints the query object itself (receiver post-update), so a later whole-value read at $db->setQuery($q) / $q->execute() is a sink. Generalises to Doctrine/CakePHP/Joomla builders; inert unless the query reaches a SQL sink (benchmark FP unchanged).
• WP apply_filters($tag, $value, …) carries taint arg1→return — the central WP value-passing idiom: every plugin accessor/option read funnels a value through apply_filters, which returns it (filtered, or unchanged when no hook is attached). Left unmodeled it silently dropped taint mid-flow, hiding any request→accessor→sink path that crosses a filter (Web Directory Free CVE-2024-3552, whose w2dc_getValue() accessor pipes every request value through it). Benchmark FP unchanged at 40/176.
• Laravel request()->route('x') — receiver→return taint step for the route-parameter accessor of a tainted request.
• Laravel Storage facade chain — a structural path-traversal sink for Storage::disk('x')->{path,get,put,download,delete,readStream,…}($p); the disk() factory return type is unresolvable, so the sink is matched on the recognisable Storage::disk(...) receiver (scoped, no generic ->path() false positives).