phalcon/cphalcon
Composer · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) | phalcon/cphalcon | Composer | Critical | Fix reported | |
| Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS | phalcon/cphalcon | Composer | High | Fix reported | |
| Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) | phalcon/cphalcon | Composer | High | Fix reported |