Flightphp vulnerabilities
We track 4 vulnerabilities in Flightphp products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on May 13, 2026.
Latest Flightphp vulnerabilities
- 7.5 High severity
core: Generation of Error Message Containing Sensitive Information
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no d
- 7.5 High severity
core: Interpretation Conflict
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no wh
- 8.8 High severity
core: Improper Neutralization of Special Elements used in an SQL Command
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no ident
- 8.6 High severity
core: Improper Neutralization of Input During Web Page Generation
Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can