TI-2026-30828 CVE-2026-42548 · GHSA-fcx8-ph5r-mxr4
Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()
Priority HIGH 78
Flight is an extensible micro-framework for PHP.
flightphp
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
flightphp records in CISA KEVNo flightphp vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2026-30830 CVE-2026-42550 · GHSA-xwqr-rcqg-22mr
Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Priority HIGH 73
Flight is an extensible micro-framework for PHP.
TI-2026-30832 CVE-2026-42552 · GHSA-qrch-52m5-vv85
Flight: Sensitive information disclosure via default error handler in flightphp/core
Priority HIGH 72
Flight is an extensible micro-framework for PHP.
TI-2026-30831 CVE-2026-42551 · GHSA-vxrr-w42w-w76g
Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core
Priority HIGH 72
Flight is an extensible micro-framework for PHP.
TI-2014-08426 CVE-2014-125127 · GHSA-q996-685m-c683
Denial of Service (DoS) vulnerability in mikecao/flight
Priority HIGH 72
The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor.
TI-2026-30829 CVE-2026-42549 · GHSA-3xjv-pmf2-gf2q
Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root
Priority MEDIUM 54
Flight is an extensible micro-framework for PHP.