CVE-2020-25912

9.1 criticalEPSS 1.4%

Critical (9.1) in getsymphony symphony. EPSS 1.4% chance of exploitation in the next 30 days.

A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2021-10-31
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

getsymphony:symphony

References

https://github.com/symphonycms/symphonycms/issues/2924
https://github.com/symphonycms/symphonycms/issues/2924

Check your stack JSON