symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony is used by thousands of web applications and most of the popular PHP projects. Installation Install Symfony with Composer see requirements details. Symfony follows the semantic versioning...

CVE-2024-51996

⚠️ CVE-2024-51996 - Symfony RememberMe Auth Bypass Exploit Exploit for the critical vulnerability CVE-2024-51996 , which allows authentication bypass in Symfony applications that use the Remember Me mechanism. 🧠 Impact : Impersonation of privileged users such as admin without the need for valid...

CVE-2024-50340

CVE-2024-50340 POC Requirements The registerargcargv option must be enabled in the PHP configuration file php.ini. This setting loads command-line arguments and query params into $SERVER'argv'. https://www.php.net/manual/en/ini.core.phpini.register-argc-argv Explanation of Vulnerable Code This...

CVE-2025-25599

CVE-2025-25599 Details Bolt is an open-source content management system built using the Symfony PHP framework. During a short security assessment, Certitude identified several vulnerabilities including an arbitrary file read. Users with the role EDITOR , CHIEFEDITOR , ADMIN , or DEVELOPER may abu...

badsecrets

badsecrets A pure python library for identifying the use of known or very weak cryptographic secrets across a variety of platforms. The project is designed to be both a repository of various "known secrets" for example, ASP.NET machine keys found in examples in tutorials, and to provide a...

eos

Enemies Of Symfony EOS EOS loots information from a Symfony target in debug mode: Section| Description ---|--- General| Get general information about the target. Phpinfo| Extract Symfony environment variables from the exposed phpinfo. Routes| Get the list of registered routes. Request logs| Look...

versionscan

versionscan Versionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. PLEASE NOTE: Work is still in progress to adapt the tool to linux distributions that backport security fixe...

CVE-2026-33715

CVE-2026-33715 — Unauthenticated SSRF + Open Email Relay in Chamilo LMS via install.ajax.php Severity : High CVSS 7.2 CWE : CWE-918 SSRF + CWE-306 Missing Authentication Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-mxc9-9335-45mc NVD :...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

Symfony - Authentication Bypass

Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including 1 no hash or 2 an invalid has...

Symfony HttpFoundation - Access Control Bypass via PATH_INFO

Symfony HttpFoundation component = 2.0.0 and prior to versions 5.4.50, 6.4.29, and 7.3.7 contains an access control bypass vulnerability. The Request class improperly interprets some PATHINFO values, producing URL paths without a leading /. This allows bypassing access control rules that are buil...

Symfony-CVE-Scanner-PoC-

Symfony Vulnerability Scanner Automated scanning tool to detect multiple known vulnerabilities CVE in Symfony applications exposed to the Internet. Developed by m10sec. Features 🔍 Detection of multiple vulnerabilities in Symfony : Validation of Symfony vulnerabilities ✅ Real exploitation validati...

CVE-2021-21424

CVE-2021-21424 Directory Traversal and file exposure • CVE-2021-21424 • Description: WebProfiler exposes internal server paths if it is not disabled in production. • Affected versions: Symfony 2.8 to 5.x. • Typical bypass: direct access to /appdev.php/profiler/. Summary of CVE-2021-21424 • CVE:...

CVE-2026-109449

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property access...

UBUNTU-CVE-2026-109449

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property access...

UBUNTU-CVE-2026-109413

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for every and of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A documen...

UBUNTU-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-109413

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for every and of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A documen...

CVE-2026-109449

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property access...