Fflightphp

Products

Exploited and recent CVEs

• CVE-2026-42552 High 7.5 Flight: Sensitive information disclosure via default error handler in flightphp/core 0.3%
• CVE-2026-42551 High 7.5 Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core 0.4%
• CVE-2026-42550 High 8.8 Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete 0.5%
• CVE-2026-42549 Medium 4.4 Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root 0.2%
• CVE-2026-42548 High 8.6 Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() 0.4%