ZF
Product
Zend Framework
27
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 3Medium 3Low 0
Watch
Add Zend Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-29312 | 9.8 | Apr 4 | An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function Affected: through 3.1.3 |
| CVE-2021-3007 | 9.8 | Jan 4 | Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable,… Affected: 3.0.0 |
| CVE-2014-8089 | 9.8 | Feb 17 | SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute… Affected: before 1.12.9; 2.2.0 before 2.2.8; 2.3.0 before 2.3.3 |
| CVE-2011-1939 | 9.8 | Nov 26 | SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6 Affected: 1.10.0 before 1.10.9; 1.11.0 before 1.11.6 |
| CVE-2014-4914 | 9.8 | Dec 29 | The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via… Affected: before 1.12.7 |
| CVE-2016-6233 | 9.8 | Feb 17 | The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use… Affected: through 1.12.19 |
| CVE-2016-4861 | 9.8 | Feb 17 | The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to… Affected: through 1.12.19 |
| CVE-2016-10034 | 9.8 | Dec 30 | The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote… Affected: through 2.4.10 |
| CVE-2015-7695 | 9.8 | Jun 7 | The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query Affected: through 1.12.15 |
| CVE-2015-1555 | 9.1 | Aug 7 | Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +7 more |
| CVE-2012-3363 | 9.1 | Feb 13 | Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files… Affected: 1.0.0 before 1.11.12; 1.12.0; 1.12.0; 1.12.0; 1.12.0 |
Showing 11