Zend

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-29312 1Zend 1Zend Framework Feb 18, 2025 Apr 4, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework...Show more An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.Show less
CVE-2021-27888 1Zend 1Zendto Nov 21, 2024 Mar 2, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.
CVE-2021-3007 2Getlaminas Zend 2Laminas Http Zend Framework Nov 21, 2024 Jan 4, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zen...Show more Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserializedShow less
CVE-2020-8986 1Zend 1Zendto Nov 21, 2024 Mar 24, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.
CVE-2020-8985 1Zend 1Zendto Nov 21, 2024 Mar 24, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
CVE-2020-8984 1Zend 1Zendto Nov 21, 2024 Mar 24, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.
CVE-2014-8089 3Fedoraproject RedhatZend 3Enterprise Linux FedoraZend Framework Nov 21, 2024 Feb 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
CVE-2015-3154 1Zend 1Zend Framework Nov 21, 2024 Jan 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splittin...Show more CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.Show less
CVE-2012-4451 3Fedoraproject RedhatZend 3Enterprise Linux FedoraZend Framework Nov 21, 2024 Jan 3, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Fo...Show more Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.Show less
CVE-2014-4913 2Debian Zend 2Debian Linux Zend Framework Nov 21, 2024 Dec 15, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 ZF2014-03 has a potential cross site scripting vector in multiple view helpers
CVE-2011-1939 3Debian PhpZend 3Debian Linux PhpZend Framework Nov 21, 2024 Nov 26, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.
CVE-2015-0270 1Zend 1Framework Nov 21, 2024 Oct 25, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
CVE-2018-1000841 1Zend 1Zendto Nov 21, 2024 Dec 20, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of the victim's browser.. T...Show more Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of the victim's browser.. This attack appear to be exploitable via HTTP POST request. This vulnerability appears to have been fixed in 5.16-1 Beta.Show less
CVE-2018-10230 1Zend 1Zend Server Nov 21, 2024 Apr 19, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455.
CVE-2014-4914 2Debian Zend 2Debian Linux Zend Framework May 13, 2026 Dec 29, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
CVE-2015-7503 1Zend 1Zend Framework May 13, 2026 Oct 10, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.
CVE-2015-3257 1Zend 1Diactoros May 13, 2026 Aug 25, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks.
CVE-2015-1555 1Zend 1Zend Framework May 13, 2026 Aug 7, 2017 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.
CVE-2015-1786 1Zend 1Zend Framework May 13, 2026 Jun 8, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.
CVE-2016-6233 2Fedoraproject Zend 2Fedora Zend Framework May 13, 2026 Feb 17, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regu...Show more The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.Show less

12 3 Next