Skip to content
OpenAdvisories

Package · Debian

symfony

101 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2026-45071 Public exploit

    Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity reso…

    symfony symfony dom-crawler symfony/symfony Debian Ubuntu Packagist
  • High 7.5
    CVE-2024-51996 Public exploit

    Symphony has an Authentication Bypass via RememberMe

    Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie…

    symfony symfony symfony symfony Debian Ubuntu Packagist
  • High 7.3
    CVE-2024-50340 Public exploit EPSS 62%

    Ability to change environment from query in symfony/runtime

    symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to c…

    symfony symfony symfony/symfony symfony Debian Ubuntu Packagist