Flightphp - vulnerabilities (CVEs)
6 CVEs in 2 products, 0 in the last 30 days, newest from 2026-05-13.
Products
Newest CVEs of Flightphp
- CVE-2026-42550 - CVSS 8.8 (high), 2026-05-13: Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by…
- CVE-2026-42552 - CVSS 7.5 (high), 2026-05-13: Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception…
- CVE-2026-42551 - CVSS 7.5 (high), 2026-05-13: Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the…
- CVE-2026-42549 - CVSS 4.4 (medium), 2026-05-13: Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command calls mkdir(..., recursive: true) on a path built from the…
- CVE-2026-42548 - CVSS 8.6 (high), 2026-05-13: Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an…
- CVE-2014-125127 - CVSS 7.5 (high), 2025-09-03: The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the…
