CVE-2019-10909

score

<0.1

cvss

5.4

epss

1.0%

published

2019-05-16

kev added

—

first seen

2026-10-21

Symfony < 2.7.51, 2.8.x < 2.8.50, 3.x < 3.4.26, 4.x < 4.1.12, and 4.2.x < 4.2.7 contain a reflected cross-site scripting caused by unescaped validation messages in symfony/framework-bundle, letting attackers inject malicious scripts when user input is included, exploit requires user input to be included in validation messages.