Symfony — фреймворк c открытым исходным кодом, написанный на PHP.

Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

Symfony hardened the parser when handling untrusted input

Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener

Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address