TI-2026-30832 CVE-2026-42552 · GHSA-qrch-52m5-vv85
Flight: Sensitive information disclosure via default error handler in flightphp/core
Priority HIGH 72
Flight is an extensible micro-framework for PHP.
Vulnerabilities
6 records
TI-2026-30831 CVE-2026-42551 · GHSA-vxrr-w42w-w76g
Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core
Priority HIGH 72
Flight is an extensible micro-framework for PHP.
TI-2026-30830 CVE-2026-42550 · GHSA-xwqr-rcqg-22mr
Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Priority HIGH 73
Flight is an extensible micro-framework for PHP.
TI-2026-30829 CVE-2026-42549 · GHSA-3xjv-pmf2-gf2q
Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root
Priority MEDIUM 54
Flight is an extensible micro-framework for PHP.
TI-2026-30828 CVE-2026-42548 · GHSA-fcx8-ph5r-mxr4
Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()
Priority HIGH 78
Flight is an extensible micro-framework for PHP.
TI-2014-08426 CVE-2014-125127 · GHSA-q996-685m-c683
Denial of Service (DoS) vulnerability in mikecao/flight
Priority HIGH 72
The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor.