MEDIUM6.1PackagistGHSA-rrvc-c7xg-7cf3· CVE-2024-37156TokenController formName not sanitized in hidden inputModified: 9/10/2026