applications.md

Additional PHP application coverage

Reviewed 2026-10-22. This catalogue update adds 59 applications beyond Roundcube and the previously recognised CMS/application names. The set covers common deployment categories; it is not a statistical ranking of the most popular PHP products. Frameworks remain a separate catalogue.

Selection was informed by the W3Techs CMS survey and WhatCMS technology categories. PHP implementation and signal details were checked against the linked project sources or the vendors' own documentation. These catalogue rules are independently written, not copied from a third-party scanner database.

Category	New applications
Forums	6
CMS	4
Publishing	1
Wikis	5
Database administration	3
Files and collaboration	4
Help desks	4
CRM and business	6
Learning	4
Analytics and publishing	7
Galleries	4
Business tools	6
Commerce	1
Monitoring	1
Social networking	1
Webmail	2

Coverage and sources

All entries accept explicit application names in generator or identity headers. The table lists the additional researched signals or a generator that the linked template actually emits. A generator or application version MUST NOT become a PHP version.

Application	Category	Researched signal	Primary source
XenForo	Forums	cookie xf_session; cookie xf_csrf; cookie xf_user	Source
Invision Community	Forums	cookie ips4_IPSSessionFront; cookie ips4_member_id; cookie ips4_login_key	Source
MyBB	Forums	cookie mybbuser	Source
Simple Machines Forum	Forums	SMF logo ID and alt text	Source
Bludit	CMS	cookies BLUDIT-KEY, __Secure-BLUDIT-KEY	Source
ProcessWire	CMS	cookies wire, wires	Source
Serendipity	Publishing	generator meta tag	Source
MODX	CMS	HTTP 5xx diagnostic identifier MODX\Revolution\	Source
Flarum	Forums	cookie flarum_remember; cookie flarum_session	Source, Source
bbPress	Forums	CSS css/bbpress.css	Source
DokuWiki	Wikis	generator meta tag	Source
PmWiki	Wikis	CSS pmwiki-core.css	Source
Tiki Wiki	Wikis	generator meta tag	Source
WackoWiki	Wikis	CSS css/wacko.css	Source
BookStack	Wikis	cookie bookstack_session	Source
phpMyAdmin	Database administration	cookie phpMyAdmin	Source
Adminer	Database administration	cookie adminer_sid	Source
phpPgAdmin	Database administration	cookie PPA_ID	Source
Nextcloud	Files and collaboration	cookie nc_sameSiteCookielax; cookie nc_sameSiteCookiestrict; cookie __Host-nc_sameSiteCookielax; cookie __Host-nc_sameSiteCookiestrict	Source
ownCloud	Files and collaboration	branded link within the application footer	Source
FileGator	Files and collaboration	HTTP 5xx diagnostic identifier Filegator\	Source
Tiny File Manager	Files and collaboration	login field pair inside one form	Source
osTicket	Help desks	cookie OSTSESSID	Source
GLPI	Help desks	GLPI theme and request-ID attributes on the same HTML element; cookie ^glpi_[0-9a-f]{32}$ (10.0); cookie ^glpi_[0-9a-f]{128}$ (11)	Source, Source, Source
FreeScout	Help desks	branded link within the application footer	Source
UVdesk	Help desks	script bundles/uvdeskcoreframework/js/_dropdown.js, bundles/uvdeskcoreframework/js/viewer.js	Source
Dolibarr	CRM and business	cookie ^DOLSESSID_[0-9a-f]{40}$	Source
EspoCRM	CRM and business	HTTP 5xx diagnostic identifier Espo\	Source
SuiteCRM	CRM and business	script themes/SuiteP/js/jscolor.js, cache/include/javascript/sugar_field_grp.js	Source
Vtiger	CRM and business	script include/js/vtlib.js, include/js/general.js	Source
CiviCRM	CRM and business	HTTP 5xx diagnostic identifier CRM_Core_Session	Source
Mautic	CRM and business	HTTP 5xx diagnostic identifier Mautic\	Source
Moodle	Learning	cookie MoodleSession	Source
Chamilo	Learning	generator meta tag; cookie ch_sid	Source, Source
ILIAS	Learning	cookie ilClientId	Source
Mahara	Learning	generator meta tag	Source
LimeSurvey	Analytics and publishing	generator meta tag; cookie ^LS-[A-Z]{16}$	Source, Source
Matomo	Analytics and publishing	cookie MATOMO_SESSID; header X-Matomo-Request-Id	Source, Source
YOURLS	Analytics and publishing	generator meta tag	Source
wallabag	Analytics and publishing	cookie wllbg_trusted_computer	Source
FreshRSS	Analytics and publishing	cookie FreshRSS	Source
Tiny Tiny RSS	Analytics and publishing	script js/tt-rss.js, lib/dojo/tt-rss-layer.js	Source
Shaarli	Analytics and publishing	CSS css/shaarli.min.css	Source
Piwigo	Galleries	generator meta tag	Source
Coppermine	Galleries	CSS css/coppermine.css	Source
Zenphoto	Galleries	script js/zp_general.js	Source
Lychee	Galleries	cookie lychee_session	Source
Invoice Ninja	Business tools	cookie invoice_ninja_session	Source
InvoicePlane	Business tools	cookie ip_session; cookie ip_csrf_cookie	Source
Akaunting	Business tools	cookie akaunting_session	Source
Snipe-IT	Business tools	cookie snipeitv6_session	Source
Kanboard	Business tools	cookie KB_SID	Source
phpList	Business tools	paired branded icon links	Source
XOOPS	CMS	generator meta tag	Source
Zen Cart	Commerce	cookie zenid	Source
Zabbix	Monitoring	cookie zbx_session	Source
Elgg	Social networking	cookie Elgg	Source
SquirrelMail	Webmail	cookie SQMSESSID	Source
Horde	Webmail	cookie Horde	Source

Conditions and limits

• Cookie names are low-confidence hints. Names, prefixes and application names are configurable. MyBB and wallabag cookies and Flarum's flarum_remember may appear only in authenticated or remembered-session contexts; their absence says nothing.
• GLPI and LimeSurvey session names carry an installation-specific part. The rules require its exact length and alphabet. Elgg and Horde session names are configurable; only their defaults are recognised.
• Nextcloud protected-cookie variants are recognised explicitly. Generic ownCloud/Nextcloud session IDs are not used to distinguish the products.
• Invoice Ninja and Akaunting cookie names are derived from the shipped application-name examples and session configuration. Customized names are not guessed. Moodle recognition uses its default cookie name.
• Dolibarr recognition requires its named prefix and a 40-character SHA-1 suffix. An arbitrary similarly prefixed cookie is not sufficient.
• Assets and branding can be copied, cached or reused. They are component evidence with low confidence, not proof that the requested page executes PHP.
• Generic JavaScript/CSS names, product mentions, titles and ordinary article links do not identify an application. Required markup attributes must occur together on the intended element or within the designated container.
• MODX, FileGator, EspoCRM, CiviCRM and Mautic currently have diagnostic or explicit-identity coverage only. Diagnostics require an existing HTTP 5xx response with an exception/trace context. The checker induces no errors and requests no debug endpoints.
• These are application-family rules, not guarantees across every version, skin or installation. Some sources intentionally cover older deployed themes. Challenges, branding changes, disabled diagnostics and custom cookies can hide all signals.

Additional references establish configurable defaults or emitted branding:

• Flarum: reference.
• ownCloud: reference.
• FreeScout: reference.
• Dolibarr: reference.
• Invoice Ninja: reference.
• Akaunting: reference.
• Zen Cart: reference.
• Zabbix: reference.

Verification

Each of the 59 entries has a separate synthetic response fixture derived from the cited producers or documentation. Tests verify the detected name, provenance, confidence, verdict integration and PHP-version separation. Negative cases cover generic cookies, lookalikes, invalid hash suffixes, ordinary article links, comments, unrelated assets, split attributes and unrelated login forms. Request IDs, cookie values and trace contents are not copied into fingerprint evidence.

The catalogue consumes existing bounded responses. It adds no target requests, login attempts or authenticated inspection. These fixtures are not live acceptance tests against 59 deployed applications. See fingerprints.md for framework and Roundcube coverage, and detection.md for discovery and blocked inspection.

Validation of this extension on 2026-10-22: make test and make build passed. The PHP lab checks patched, unpatched and hardened PHP plus a static server; application-family coverage is established by the separate fixtures.

Further coverage

Bludit is recognised by BLUDIT-KEY and its HTTPS __Secure- variant (session source). ProcessWire is recognised by the default wire and HTTPS wires cookies (configuration). Serendipity is recognised by its generator declaration (template). Piwigo additionally accepts the pwg_id cookie when its generator is absent (configuration). Cookie names are configurable and MUST remain low-confidence indicators. These rules inspect responses already fetched and add no requests.