CVE-2026-42548— Flight 跨站脚本漏洞

Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp()

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier. An attacker can inject arbitrary JavaScript that executes in the response origin, enabling reflected cross-site scripting. This vulnerability is fixed in 3.18.1.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Flight 跨站脚本漏洞

Flight是Mike Cao个人开发者的一个PHP微框架。 Flight 3.18.1之前版本存在跨站脚本漏洞，该漏洞源于Flight::jsonp()将?jsonp=查询参数直接连接到application/javascript响应体中，未验证值是否为合法JavaScript标识符，可能导致反射型跨站脚本攻击。

N/A

N/A