Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes including action, formaction, poster, and cite, so configurations that admit those attributes can leave javascript: URIs unsanitized and enable XSS when the resulting HTML is rendered or a victim submits a form or clicks a button. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔵 Symfony HtmlSanitizer, Cross-site Scripting (XSS), #CVE-2026-45753 (Low) -DC-Jul2026-1005 https://dailycve.com/symfony-htmlsanitizer-cross-site-scripting-xss-cve-2026-45753-low-dc-jul2026-1005/
Post summary
CVE‑2026‑45753 is an XSS vulnerability in Symfony HtmlSanitizer reported with low severity; the post offers no PoC, exploit, patch, or evidence of active exploitation.
🟠 Symfony HtmlSanitizer, Multiple XSS Vulnerabilities (#CVE-2026-48761 & #CVE-2026-45753) (Medium) -DC-Jun2026-402 https://dailycve.com/symfony-htmlsanitizer-multiple-xss-vulnerabilities-cve-2026-48761-cve-2026-45753-medium-dc-jun2026-402/
Post summary
DailyCVE alerts about multiple Medium-rated XSS vulnerabilities in Symfony HtmlSanitizer (CVE-2026-48761 & CVE-2026-45753) but provides no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sensiolabs | symfony | - | - | - |