Skip to content
OpenAdvisories

Package · Packagist

symfony/framework-bundle

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2014-4931

    Code injection in the way Symfony implements translation caching in FrameworkBundle

    When investigating issue [#11093](https://github.com/symfony/symfony/issues/11093), [Jeremy Derussé](https://connect.sensiolabs.com/profile/jderusse) found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle. - …

    symfony/symfony symfony/framework-bundle Packagist
  • High 8.1
    CVE-2022-23601

    CSRF token missing in Symfony

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token…

    symfony symfony symfony/framework-bundle Packagist
  • Medium 5.4
    CVE-2019-10909 Public exploit

    Symfony Cross-site Scripting (XSS) vulnerability

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

    drupal/core symfony/symfony symfony symfony Debian Ubuntu Packagist