Symfony — фреймворк c открытым исходным кодом, написанный на PHP.

Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix

Symfony Vulnerable to stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering

Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification

Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing