What’s Vulnerable › Products

flightphp core vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your flightphp core version is affected

Latest flightphp core vulnerabilities

• CVE-2026-42552 — Flight: Sensitive information disclosure via default error handler in flightphp/core (CVSS 7.5)
• CVE-2026-42551 — Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core (CVSS 7.5)
• CVE-2026-42550 — Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete (CVSS 8.8)
• CVE-2026-42549 — Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root (CVSS 4.4)
• CVE-2026-42548 — Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() (CVSS 8.6)