Cross-site Scripting (XSS)

zendframework/zendframework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to view helpers using escapeHtml instead of escapeHtmlAttr to escape HTML attributes, which can lead to potential XSS attack vectors when user data or JavaScript is used...

Cross-Site Scripting (XSS)

zendframework/zend-navigation is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the use of the escapeHtml view helper instead of escapeHtmlAttr, leading to improper HTML attribute escaping...

Zend-Form vulnerable to Cross-site Scripting

Many Zend Framework 2 view helpers were using the escapeHtml view helper in order to escape HTML attributes, instead of the more appropriate escapeHtmlAttr. In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting XSS attack...

GHSA-8Q77-CV62-JJ38 Zendframework has potential Cross-site Scripting vector in multiple view helpers

Many Zend Framework 2 view helpers were using the escapeHtml view helper in order to escape HTML attributes, instead of the more appropriate escapeHtmlAttr. In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting XSS attack...

PT-2024-40135

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 affected versions not specified Description: The issue arises from the use of the escapeHtml view helper instead of the more appropriate escapeHtmlAttr to escape HTML attributes in various Zend Framework 2 view helpers. This...

PT-2024-40200

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 affected versions not specified Description: The issue arises from the use of the escapeHtml view helper instead of the more appropriate escapeHtmlAttr to escape HTML attributes in various Zend Framework 2 view helpers. This...