Skip to content

Product

symfony/form vulnerabilities

3 published CVES affecting symfony/form, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest symfony/form CVEs

Newest publication first

  1. CVE-2018-19789 Symfony Path Disclosure

    Published
    MediumCVSS 5.3 EPSS 3.6% PoC

    An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint string in a setter method (e.g. setName(string $name)) of a class that's the data_class...

  2. CVE-2017-16790 Symfony SSRF Vulnerability via Form Component

    Published
    MediumCVSS 6.5 EPSS 1.6% PoC

    An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. This big array forms the data that a...

  3. CVE-2015-8125 Symfony Vulnerable to Timing Attack

    Published
    HighCVSS 7.5 EPSS 2.5% PoC

    Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Securi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.