flightphp vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20265

Newest CVEs

• CVE-2026-42552

  Flight: Sensitive information disclosure via default error handler in flightphp/core

  flightphp · core

  High7.5
• CVE-2026-42551

  Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core

  flightphp · core

  High7.5
• CVE-2026-42550

  Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete

  flightphp · core

  High8.8
• CVE-2026-42549

  Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root

  flightphp · core

  Medium4.4
• CVE-2026-42548

  Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()

  flightphp · core

  High8.6
• CVE-2014-125127

  Denial of Service (DoS) vulnerability in mikecao/flight

  flightphp · core

  High7.5