CVE-2019-10909

🗓️ 16 May 2019 21:36:10Reported by MendType

Unescaped validation messages in symfony/framework-bundle can lead to XSS.

Reporter	Title	Published	Views	Family All 70
FreeBSD	drupal -- Drupal core - Moderately critical	17 Apr 201900:00	–	freebsd
BDU FSTEC	symfony framework-bundle XSS	24 Feb 202000:00	–	bdu_fstec
Circl	CVE-2019-10909	16 May 201922:51	–	circl
CNVD	Drupal cross-site scripting vulnerability (CNVD-2019-13249)	22 Apr 201900:00	–	cnvd
CVE	CVE-2019-10909	16 May 201921:36	–	cve
Cvelist	CVE-2019-10909	16 May 201921:36	–	cvelist
Debian	[SECURITY] [DLA 1778-1] symfony security update	6 May 201919:15	–	debian
Debian	[SECURITY] [DSA 4441-1] symfony security update	10 May 201906:26	–	debian
Debian	[SECURITY] [DSA 4441-1] symfony security update	10 May 201906:26	–	debian
Debian CVE	CVE-2019-10909	16 May 201921:36	–	debiancve

Vulners

Node

sensiolabs symfonyRange3.0.0–3.4.26

sensiolabs symfonyRange2.8.0–2.8.50

drupal drupalRange8.6.0–8.6.15

drupal drupalRange8.0.0–8.5.15

sensiolabs symfonyRange4.0.0–4.1.12

sensiolabs symfonyRange4.2.0–4.2.7

sensiolabs symfonyRange2.7.0–2.7.51

Source	Link
github	www.github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml
symfony	www.symfony.com/cve-2019-10909
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-10909
symfony	www.symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml
drupal	www.drupal.org/sa-core-2019-005
synology	www.synology.com/security/advisory/Synology_SA_19_19

06 Oct 2026 02:37Current

CVSS 45.1

CVSS 3.15.4

CVSS 23.5

EPSS0.01029