4 results · Clear filters · Feed
-
High 7.5
Flight: Sensitive information disclosure via default error handler in flightphp/core
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no …
-
High 7.5
Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no w…
-
High 8.8
Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no iden…
-
High 8.6
Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker ca…