Lucene search

K
osvGoogleOSV:GHSA-VVM3-RV48-J3G5
HistoryJun 07, 2024 - 9:52 p.m.

Zendframework Potential XSS or HTML Injection vector in Zend_Json

2024-06-0721:52:44
Google
osv.dev
2
zendframework
json specification
html injection

6.3 Medium

AI Score

Confidence

High

Zend_Json_Encoder was not taking into account the solidus character (/) during encoding, leading to incompatibilities with the JSON specification, and opening the potential for XSS or HTML injection attacks when returning HTML within a JSON string.

6.3 Medium

AI Score

Confidence

High