Exposição de Symfony

Web frameworks
82
score de exposição
9.704
sites usam
0
em exploração
1
críticos
Análise Vexday

O histórico de vulnerabilidades catalogadas para o framework Symfony soma 24 CVEs, sem registros de exploração ativa confirmada no catálogo CISA KEV e sem entradas de severidade crítica, o que posiciona a tecnologia abaixo da média geral do catálogo em termos de taxa de exploração. Ainda assim, merece atenção o fato de que a CVE mais perigosa atualmente identificada, CVE-2024-50340, apresenta um score EPSS de aproximadamente 0,63, indicando probabilidade relevante de exploração prática em curto prazo. O tipo de falha mais recorrente é CWE-287 (autenticação inadequada), padrão que costuma facilitar acesso não autorizado quando não mitigado adequadamente. Equipes responsáveis por ambientes baseados em Symfony devem priorizar a revisão dos mecanismos de autenticação e acompanhar ativamente a evolução do risco associado a CVE-2024-50340.

CVEs

53 resultados
CVE-2026-45756HIGHSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSEPSS 0.6%CVE-2023-46735MEDIUMSymfony potential Cross-site Scripting in WebhookControllerEPSS 0.6%CVE-2022-23601HIGHCSRF token missing in SymfonyEPSS 0.6%CVE-2024-50345LOWOpen redirect via browser-sanitized URLs in symfony/http-foundationEPSS 0.6%CVE-2024-50342LOWInternal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-clientEPSS 0.5%CVE-2026-48489HIGHSymfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET RoutesEPSS 0.5%CVE-2024-50343LOWIncorrect response from Validator when input ends with `\n` in symfony/validatorEPSS 0.5%CVE-2026-45071HIGHSymfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = trueEPSS 0.5%CVE-2026-48736MEDIUMSymfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClientEPSS 0.5%CVE-2026-45077HIGHSymfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log ListenerEPSS 0.4%CVE-2024-51736NONECommand execution hijack on Windows with Process class in symfony/processEPSS 0.4%CVE-2026-45074HIGHSymfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket ReplayEPSS 0.4%CVE-2026-45073MEDIUMSymfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefixEPSS 0.4%CVE-2026-45068HIGHSymfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient AddressEPSS 0.4%CVE-2026-47767HIGHSymfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv MismatchEPSS 0.4%CVE-2026-45075HIGHSymfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]EPSS 0.4%CVE-2026-45754MEDIUMSymfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event InjectionEPSS 0.3%CVE-2026-45063CRITICALSymfony: Identity Spoofing via Unanchored DN Regex in X509AuthenticatorEPSS 0.3%CVE-2024-50341LOWSecurity::login does not take into account custom user_checker in symfony/security-bundleEPSS 0.3%CVE-2026-45066LOWSymfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> MisclassificationEPSS 0.3%