core

6 results · Feed

• High 7.5
  CVE-2026-42552

  Flight: Sensitive information disclosure via default error handler in flightphp/core

  Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no …

  flightphp core flightphp/core Packagist
  May 13, 2026
• High 7.5
  CVE-2026-42551

  Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core

  Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no w…

  flightphp core flightphp/core Packagist
  May 13, 2026
• High 8.8
  CVE-2026-42550

  Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete

  Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no iden…

  flightphp core flightphp/core Packagist
  May 13, 2026
• Medium 4.4
  CVE-2026-42549

  Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root

  Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is corr…

  flightphp core flightphp/core Packagist
  May 13, 2026
• High 8.6
  CVE-2026-42548

  Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()

  Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker ca…

  flightphp core flightphp/core Packagist
  May 13, 2026
• High 7.5
  CVE-2014-125127

  Denial of Service (DoS) vulnerability in mikecao/flight

  The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HTTP reques…

  flightphp core
  Sep 3, 2025