Advisories for package flightphp/core

Listing reported advisories for package flightphp/core sorted by their report date.

Flight vulnerable to sensitive information disclosure via default error handler
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:39:11
Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:38:16
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:36:19
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:34:40
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()
GitHub

flightphp/core

< 3.18.1

2026-05-06 21:34:15

Need help?

We are happy to help you with any questions you might have.

Documentation Roadmap Report a bug Get in touch