A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP
Denial Of Service
Information Disclosure
XXE
Symphony
+1
NVD
GitHub
VulDB
CVSS 3.1
9.1
EPSS
1.4%