Doctrine security advisories

All Doctrine advisories

6 advisories, newest first.

• medium Doctrine · Nov 3, 2026 · Reviewed Nov 3

  Doctrine MongoDB ODM: Encrypted Fields Can Be Stored as Plain Text

  Can store fields marked #[Encrypt] unencrypted in MongoDB collections that mix a class's own encrypted fields with encrypted embedded documents.

  Fixed in 2.17.3

• critical Doctrine · Nov 11, 2021

  SQL Injection in Limit Clause Generation API

  Fixed in 3.1.4 · 1 older release

• critical Doctrine · Apr 6, 2021

  Regression in Query Parenthesis can have Security Implications

  Fixed in 2.8.4

• high Doctrine · Aug 31, 2015

  Security Misconfiguration Vulnerability in various Doctrine projects

  Fixed in 3.0.1 and 2.5.1 · 7 older releases

• medium Doctrine · May 16, 2013

  Authentication Vulnerability - possible attempt to login via zero-valued password credential

  Fixed in 0.7.2

• high Doctrine · Sep 25, 2011

  SQL injection possibility

  Fixed in 2.1.2 · 2 older releases