1961 matches found
XML decoding attack vector through external entities
More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...
SQL injection possibility
More info at https://www.doctrine-project.org/blog/doctrine-security-fix.html...
SQL injection possibility
More info at https://www.doctrine-project.org/blog/dbal-security-2011-1.html...
Potential SQL Injection Vector When Using PDO_MySql
More info at https://framework.zend.com/security/advisory/ZF2011-02...
XSS vulnerability exploitable on Internet Explorer
More info at http://htmlpurifier.org/news/2010/0531-4.1.1-released...
XSS vulnerability exploitable on Internet Explorer
More info at http://htmlpurifier.org/news/2010/0531-4.1.1-released...
Multiple XSS vulnerabilities exploitable on Internet Explorer
More info at http://htmlpurifier.org/security/2010/css-quoting...
Potential Security Issues in Bundled Dojo Library
More info at https://framework.zend.com/security/advisory/ZF2010-07...
Potential XSS vector in Zend_Service_ReCaptcha_MailHide
More info at https://framework.zend.com/security/advisory/ZF2010-05...
Potential XSS vectors due to inconsistent encodings
More info at https://framework.zend.com/security/advisory/ZF2010-01...
Potential XSS vector in Zend_Filter_StripTags when comments allowed
More info at https://framework.zend.com/security/advisory/ZF2010-03...
Potential Security Issues in Bundled Dojo Library
More info at https://framework.zend.com/security/advisory/ZF2010-06...
Potential XSS vector in Zend_Dojo_View_Helper_Editor
More info at https://framework.zend.com/security/advisory/ZF2010-02...
XSS vector in Zend_Filter_StripTags
More info at https://framework.zend.com/security/advisory/ZF2009-02...
LFI vector in Zend_View::setScriptPath() and render()
More info at https://framework.zend.com/security/advisory/ZF2009-01...
PHP Code Injection
phpWhois PHP Code Injection\nVulnerability Overview\nphpWhois and some of its forks in versions before 5.1.0 are prone to a\ncode injection vulnerability due to insufficient sanitization of returned\nWHOIS data. This allows attackers controlling the WHOIS information of a\nrequested domain to...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...
PHP Code Injection
phpWhois PHP Code Injection\nVulnerability Overview\nphpWhois and some of its forks in versions before 5.1.0 are prone to a\ncode injection vulnerability due to insufficient sanitization of returned\nWHOIS data. This allows attackers controlling the WHOIS information of a\nrequested domain to...
PHP Code Injection
phpWhois PHP Code Injection\nVulnerability Overview\nphpWhois and some of its forks in versions before 5.1.0 are prone to a\ncode injection vulnerability due to insufficient sanitization of returned\nWHOIS data. This allows attackers controlling the WHOIS information of a\nrequested domain to...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...
HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar: Incomplete Fix for CVE-2026-48761
More info at https://github.com/symfony/symfony/security/advisories/GHSA-wm2w-4mgj-vw33...
Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
More info at https://github.com/symfony/symfony/security/advisories/GHSA-hwfg-qwvh-2wfx...
PHP Code Injection
phpWhois PHP Code Injection\nVulnerability Overview\nphpWhois and some of its forks in versions before 5.1.0 are prone to a\ncode injection vulnerability due to insufficient sanitization of returned\nWHOIS data. This allows attackers controlling the WHOIS information of a\nrequested domain to...
Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
More info at https://github.com/symfony/symfony/security/advisories/GHSA-hwfg-qwvh-2wfx...
Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass
More info at https://github.com/symfony/symfony/security/advisories/GHSA-4qpf-57w4-m3wc...
XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true
More info at https://github.com/symfony/symfony/security/advisories/GHSA-5jff-8h8q-r5qx...
Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
More info at https://github.com/symfony/symfony/security/advisories/GHSA-wg5q-m2ww-f3c9...
CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
More info at https://symfony.com/cve-2026-109413...
CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066
More info at https://symfony.com/cve-2026-118517...
CVE-2026-45077: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
More info at https://symfony.com/cve-2026-45077...
CVE-2026-45070: Email Header Injection via Non-Token Characters in Mime Parameter Names
More info at https://symfony.com/cve-2026-45070...
CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
More info at https://symfony.com/cve-2026-45071...
CVE-2026-45069: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
More info at https://symfony.com/cve-2026-45069...
CVE-2026-109449: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
More info at https://symfony.com/cve-2026-109449...
CVE-2026-118513: X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063
More info at https://symfony.com/cve-2026-118513...
CVE-2026-118514: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewalls: Incomplete Fix for CVE-2026-45075
More info at https://symfony.com/cve-2026-118514...
CVE-2024-51736: Command execution hijack on Windows with Process class
More info at https://symfony.com/cve-2024-51736...
CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
More info at https://symfony.com/cve-2026-118516...
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
More info at https://symfony.com/cve-2024-50343...
CVE-2026-118515: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File
More info at https://symfony.com/cve-2026-118515...
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
More info at https://symfony.com/cve-2024-50343...
CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator
More info at https://symfony.com/cve-2026-45063...
CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
More info at https://symfony.com/cve-2026-45065...
Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses: SSRF Filter Bypass
More info at https://github.com/symfony/symfony/security/advisories/GHSA-4qpf-57w4-m3wc...
CVE-2026-45074: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
More info at https://symfony.com/cve-2026-45074...
CVE-2019-10911: Add a separator in the remember me cookie hash
More info at https://symfony.com/cve-2019-10911...
CVE-2019-10911: Add a separator in the remember me cookie hash
More info at https://symfony.com/cve-2019-10911...
CVE-2024-50341: Security::login does not take into account custom user_checker
More info at https://symfony.com/cve-2024-50341...