Exposição de Symfony

Web frameworks
85
score de exposição
10.887
sites usam
0
em exploração
1
críticos
Análise Vexday

O histórico de vulnerabilidades catalogadas para o framework Symfony soma 24 CVEs, sem registros de exploração ativa confirmada no catálogo CISA KEV e sem entradas de severidade crítica, o que posiciona a tecnologia abaixo da média geral do catálogo em termos de taxa de exploração. Ainda assim, merece atenção o fato de que a CVE mais perigosa atualmente identificada, CVE-2024-50340, apresenta um score EPSS de aproximadamente 0,63, indicando probabilidade relevante de exploração prática em curto prazo. O tipo de falha mais recorrente é CWE-287 (autenticação inadequada), padrão que costuma facilitar acesso não autorizado quando não mitigado adequadamente. Equipes responsáveis por ambientes baseados em Symfony devem priorizar a revisão dos mecanismos de autenticação e acompanhar ativamente a evolução do risco associado a CVE-2024-50340.

CVEs

54 resultados
CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.6%CVE-2026-45756HIGHSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSEPSS 0.6%CVE-2024-51996HIGHSymphony has an Authentication Bypass via RememberMeEPSS 0.6%CVE-2026-45067MEDIUMSymfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\AddressEPSS 0.6%CVE-2026-48489HIGHSymfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET RoutesEPSS 0.6%CVE-2026-45071HIGHSymfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = trueEPSS 0.6%CVE-2026-48736MEDIUMSymfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClientEPSS 0.6%CVE-2023-46735MEDIUMSymfony potential Cross-site Scripting in WebhookControllerEPSS 0.6%CVE-2022-23601HIGHCSRF token missing in SymfonyEPSS 0.6%CVE-2024-50345LOWOpen redirect via browser-sanitized URLs in symfony/http-foundationEPSS 0.6%CVE-2026-45068HIGHSymfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient AddressEPSS 0.5%CVE-2026-50157MEDIUMAuth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKEPSS 0.5%CVE-2026-45074HIGHSymfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket ReplayEPSS 0.5%CVE-2024-50342LOWInternal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-clientEPSS 0.5%CVE-2026-45073MEDIUMSymfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefixEPSS 0.5%CVE-2024-50343LOWIncorrect response from Validator when input ends with `\n` in symfony/validatorEPSS 0.5%CVE-2026-45754MEDIUMSymfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event InjectionEPSS 0.4%CVE-2026-45075HIGHSymfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]EPSS 0.4%CVE-2024-51736NONECommand execution hijack on Windows with Process class in symfony/processEPSS 0.4%CVE-2026-45070MEDIUMSymfony: Email Header Injection via Non-Token Characters in Mime Parameter NamesEPSS 0.4%