Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

CVE-2024-44902

CVE-2024-44902 Описание уязвимости Уязвимость десериализации в Thinkphp v6.1.3–v8.0.4 позволяет злоумышленникам выполнять произвольный код. Затронутые версии Thinkphp с v6.1.3 по v8.0.4 Условие эксплуатации В фреймворке thinkphp должно быть установлено расширение Memcached. Подтверждение уязвимос...

PHPunit-Exploit

PHPunit Exploiter + Checker CVE-2017-9841 Обзор: PHPUnit — это фреймворк для модульного тестирования языка программирования PHP. Это пример архитектуры xUnit для фреймворка модульного тестирования, который зародился в SUnit и стал популярным благодаря JUnit. PHPUnit был создан Себастьяном...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — Инъекция в правила валидации CodeIgniter 4 CVE-2023-32692 — это уязвимость внедрения кода в PHP-фреймворке CodeIgniter 4, затрагивающая версии с 4.0.0 по 4.3.4. Она была исправлена в версии 4.3.5 выпущенной в июне 2023 года. Это демонстрационное окружение для всех, кто хочет с не...

symfony

Symfony는 웹 및 콘솔 애플리케이션을 위한 PHP 프레임워크 이자 재사용 가능한 PHP 컴포넌트 세트입니다. Symfony는 수천 개의 웹 애플리케이션과 대부분의 인기 있는 PHP 프로젝트에서 사용됩니다. 설치 Symfony 설치를 Composer로 수행하세요 요구 사항 세부 정보 참조. Symfony는 시맨틱 버전 관리를 엄격히 따르며, "장기 지원"LTS 버전을 게시하고 예측 가능하고 비즈니스 친화적인 릴리스 프로세스를 가지고 있습니다. 후원 Symfony 8.2는 후원자를 찾고 있습니다. 후원을 통해 Symfony...

CVE-2026-53933

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

EUVD-2026-74284

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

CVE-2026-55250

Maravel Framework (a PHP dependency-injection framework), prior to version 10.74.0 , is affected by a Token Replay Vulnerability (CVSS 8.7 HIGH). The root cause is a lifecycle mismatch: tymon/jwt-auth writes 14-day JWT blacklist entries into tagged cache, but Maravel's O(1) Atomic Lazy Eviction m...

CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

EUVD-2026-74283

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

PT-2026-88514

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

MINI-PHFW-96XM-7673

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2026-77634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail heade...

CRLF Injection

Overview cakephp/cakephp is a rapid development framework for PHP which uses commonly known design patterns like Associative Data Mapping, Front Controller, and MVC. Affected versions of this package are vulnerable to CRLF Injection via the setHeaders or addHeaders functions. An attacker can inje...

DEBIAN-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

DEBIAN-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

UBUNTU-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...