CVE-2019-10910

score

<0.1

cvss

9.8

epss

6.0%

published

2019-05-16

kev added

—

first seen

2026-10-21

Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7 contain a SQL injection and remote code execution caused by service ids allowing user input in symfony/dependency-injection, letting attackers execute arbitrary SQL commands or code remotely, exploit requires attacker to control service ids.