Priority HIGH 67
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.33247 · Published 2019-11-21 · Fixed in 3.4.35, 4.2.12 +1 CWE-94
Priority MEDIUM 62
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.57638 · Published 2018-08-03 · Fixed in 2.7.49, 2.8.44 +4 CWE-349
Priority MEDIUM 51
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06024 · Published 2019-05-16 · Fixed in 2.7.51, 2.8.50 +3 CWE-89
Priority MEDIUM 49
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04287 · Published 2017-02-07 · Fixed in 2.8.6, 3.0.6 CWE-287
Priority MEDIUM 48
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03354 · Published 2019-11-21 · Fixed in 4.2.12, 4.3.8 CWE-116
Priority MEDIUM 47
An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02366 · Published 2018-06-13 · Fixed in 2.8.37, 3.3.17 +2 CWE-287
Priority MEDIUM 46
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not v…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01871 · Published 2019-05-16 · Fixed in 2.7.51, 2.8.50 +3 CWE-79
Priority MEDIUM 46
Certain Symfony products are affected by: Incorrect Access Control.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01855 · Published 2019-05-23 · Fixed in 2.7.32, 2.8.25 +2 CWE-284
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00596 · Published 2026-07-14 · Fixed in 5.4.53, 6.4.41 +2 CWE-863
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.00721 · Published 2026-07-14 · Fixed in 5.4.52, 6.4.40 +2 CWE-436
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00684 · Published 2026-07-14 · Fixed in 5.4.52, 6.4.40 +2 CWE-1333
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00684 · Published 2026-07-14 · Fixed in 5.4.52, 6.4.40 +2 CWE-776
Priority MEDIUM 45
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03998 · Published 2023-02-03 · Fixed in 4.4.50, 5.4.20 +3 CWE-285
Priority MEDIUM 44
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0057 · Published 2026-07-14 · Fixed in 5.4.52, 6.4.40 +2 CWE-611
Priority MEDIUM 44
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00258 · Published 2026-07-14 · Fixed in 6.4.40, 7.4.12 +1 CWE-1287
Priority MEDIUM 44
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00524 · Published 2026-07-14 · Fixed in 5.4.52, 6.4.40 +2 CWE-88
Priority MEDIUM 44
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03043 · Published 2020-09-02 · Fixed in 4.4.13, 5.1.5 CWE-212
Priority MEDIUM 43
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.0063 · Published 2026-07-14 · Fixed in 7.4.12, 8.0.12 CWE-1333
Priority MEDIUM 43
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00428 · Published 2024-11-06 · Fixed in 5.4.46, 6.4.14 +1 CWE-77
Priority MEDIUM 42
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.00429 · Published 2026-07-14 · Fixed in 7.4.12, 8.0.12 CWE-863
Priority MEDIUM 41
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00343 · Published 2026-07-14 · Fixed in 5.4.52, 6.4.40 +2 CWE-290
Priority MEDIUM 41
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00566 · Published 2022-02-01 · Fixed in 5.3.15, 5.4.4 +1 CWE-352
Priority MEDIUM 41
Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01325 · Published 2021-11-24 · Fixed in 5.3.12 CWE-384
Priority MEDIUM 41
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01388 · Published 2021-06-17 · Fixed in 5.3.2 CWE-287
Priority LOW 39
Symfony is a PHP framework for web and console applications and a set of reusable PHP components.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01506 · Published 2026-07-14 · Fixed in 6.4.40, 7.4.12 +1 CWE-306
Load more
THREATIST.IORead the docs