Symfonia vulnerabilities
We track 3 vulnerabilities in Symfonia products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on April 16, 2025.
Latest Symfonia vulnerabilities
- 7.1 High severity
Ready_: Files or Directories Accessible to External Parties
Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thus allowing the attacker to read content of the file. This vulnerability can be use to read content of
- 9.4 Critical severity
Ready_: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for SQL Injection attacks.
- 9.4 Critical severity
Ready_: Unrestricted Upload of File with Dangerous Type
The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer