CVE-2026-42548: falha de alta gravidade em flightphp core
Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.4%
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Produtos afetados
flightphp · coreCVEs relacionadas — flightphp core
No mesmo produto, das mais perigosas para as menos.
CVE-2014-125127HIGHDenial of Service (DoS) vulnerability in mikecao/flightEPSS 0.5%CVE-2026-42550HIGHFlight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / deleteEPSS 0.5%CVE-2026-42551HIGHFlight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/coreEPSS 0.4%CVE-2026-42552HIGHFlight: Sensitive information disclosure via default error handler in flightphp/coreEPSS 0.3%CVE-2026-42549MEDIUMFlight: Path traversal in `make:controller` CLI creates arbitrary directories outside project rootEPSS 0.2%