cve.bz

CVE-2019-10913

9.8 criticalEPSS 1.9%

Critical (9.8) in sensiolabs symfony. EPSS 1.9% chance of exploitation in the next 30 days.

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.

Severity

CVSS 3.0

9.8 critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWEs
CWE-79, CWE-89
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON