CVE-2021-3007

Laminas-http

CVE-2011-1939

CVE-2011-1939 is a SQL injection vulnerability in Zend Framework when using non-ASCII-compatible encodings with PDO_MySql in PHP before 5.3.6. Affected are Zend Framework 1.10.x prior to 1.10.9 and 1.11.x prior to 1.11.6. The underlying issue is in the encoding handling with PDO_MySql that can al...

CVE-2012-3363

CVE-2012-3363 : Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 mishandles SimpleXMLElement classes, enabling remote attackers to read arbitrary files or make TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request (XXE). This is cause...

CVE-2014-4914

The vulnerability CVE-2014-4914 affects Zend Framework’s Zend_Db_Select::order in versions prior to 1.12.7. The issue arises from improper handling of parentheses in the ORDER BY clause, enabling remote SQL injection via unspecified vectors. Affected product: Zend Framework (PHP framework); vulne...

CVE-2015-5161

CVE-2015-5161 affects ZendXml and Zend Framework components: ZendXml::scan in ZendXml < 1.0.1 and Zend Framework/Tmpl versions < 1.12.14, 2.x < 2.4.6, and 2.5.x

CVE-2014-2681

CVE-2014-2681 affects Zend Framework 1 (ZF1) < 1.12.4 and Zend Framework 2 < 2.1.6 / 2.2.x

CVE-2014-8089

CVE-2014-8089 describes a SQL injection in Zend Framework when using the sqlsrv PHP extension. The vulnerability affects: Zend Framework 1.x up to 1.12.9; 2.2.x before 2.2.8; and 2.3.x before 2.3.3, enabling remote attackers to execute arbitrary SQL commands via a null byte in input. Documents fr...

CVE-2012-4451

Zend Framework 2.0.x (before 2.0.1) contains multiple XSS vulnerabilities related to Escaper, exploitable via input to components such as Debug, Feed\PubSubHubbub, Log\Formatter\Xml, Tag\Cloud\Decorator, Uri, View\Helper\HeadStyle, View\Helper\Navigation\Sitemap, and View\Helper\Placeholder\Conta...

CVE-2015-5723

CVE-2015-5723 affects multiple Doctrine projects (Annotations <1.2.7; Cache <1.3.2 and 1.4.x <1.4.2; Common <2.4.3 and 2.5.x <2.5.1; ORM <2.4.8 or 2.5.x <2.5.1; MongoDB ODM <1.0.2; MongoDB ODM Bundle

CVE-2015-3154

CVE-2015-3154 is a CRLF injection vulnerability in Zend\Mail (Zend_Mail) within Zend Framework. Affected versions are Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1. The issue allows remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via...

CVE-2016-10034

CVE-2016-10034 affects Zend Framework’s zend-mail Sendmail adapter: the setFrom function can be abused by inserting additional quote characters in the recipient address to cause remote code execution. Affected: zend-mail component before 2.4.11, 2.5.x, 2.6.x, and Zend Framework before 2.4.11; and...

CVE-2014-4913

CVE-2014-4913 (ZF2014-03) describes a cross-site scripting vulnerability in Zend Framework caused by insufficient validation of client-side data in multiple view helpers. Affected versions include Zend Framework before 2.2.7 and before 2.3.1. Impact is potential execution of arbitrary script in u...

CVE-2016-4861

The CVE-2016-4861 entry concerns Zend Framework’s Zend_Db_Select (order and group methods) with a SQL injection risk due to failure to remove comments from SQL prior to validation. Affected component: Zend Framework prior to 1.12.20. Impact: remote attackers could exploit to conduct SQL injection...

CVE-2014-8088

CVE-2014-8088 affects Zend Framework: the Zend_Ldap class (Zend Framework 1.x) before 1.12.9 and Zend_Ldap component in Zend Framework 2.x before 2.2.8 and before 2.3.3 (on 2.3.x) can be abused by a password that starts with a null byte to trigger an unauthenticated bind and bypass authentication...

CVE-2012-5657

CVE-2012-5657 affects Zend Framework 1.x Zend_Feed_Rss and Zend_Feed_Atom in Zend Framework 1.11.x (<1.11.15) and 1.12.x (

CVE-2016-6233

CVE-2016-6233 affects Zend Framework (Zend_Db_Select) prior to version 1.12.19, where the order and group methods could enable remote SQL injection through vectors related to the regex pattern [\w]*. The available connected docs consistently describe this as a SQL injection vulnerability in Zend ...

CVE-2014-2685

The CVE-2014-2685 issue affects ZendOpenId (GenericConsumer in ZendOpenId) prior to 2.0.2 and Zend Framework 1 prior to 1.12.4. Root cause: the OpenID 2.0 verification logic accepts a signature that covers only at least one field, allowing an attacker to bypass authentication by leveraging an ass...

CVE-2014-2684

CVE-2014-2684 affects ZendOpenId (GenericConsumer in the Consumer component) up to version 2.0.2 and Zend Framework 1 up to 1.12.3/1.12.4, where there is a failure to verify that the openid_op_endpoint corresponds to the same Identity Provider used in the association handle. This allows an attack...

CVE-2014-2682

CVE-2014-2682 affects Zend Framework 1 up to 1.12.4 and Zend Framework 2 up to 2.1.6 (and 2.2.x before 2.2.6), plus several Zend services, where PHP-FPM threading can share libxml_disable_entity_loader state, enabling XXE via an XML external entity and an entity reference. The issue continues an ...

CVE-2014-2683

CVE-2014-2683 affects Zend Framework components (ZF1 < 1.12.4; ZF2 < 2.1.6,

CVE-2012-6531

CVE-2012-6531 affects Zend Framework 1.x: Zend_Dom, Zend_Feed, and Zend_Soap (versions before 1.11.13; 1.12.x before 1.12.0) fail to properly handle SimpleXMLElement, enabling remote XXE injection via a DOCTYPE in XML-RPC requests to read files or initiate TCP connections. This is a separate issu...

CVE-2012-6532

CVE-2012-6532 affects Zend Framework 1.x: Zend_Dom, Zend_Feed, Zend_Soap, and Zend_XmlRpc before 1.11.13 and 1.12.x before 1.12.0. It allows remote attackers to cause a denial of service via XML Entity Expansion (XEE) caused by recursive or circular references in a DOCTYPE declaration. The vulner...

CVE-2020-29312

CVE-2020-29312 affects Zend Framework in versions up to 3.1.3 (and before) and is described as allowing a remote attacker to execute arbitrary code via the unserialize function. The connected records corroborate the issue scope (Zend Framework, unserialize-based code execution, deprecated status ...

CVE-2015-7695

CVE-2015-7695 affects Zend Framework’s PDO adapters in versions before 1.12.16. The issue is that null bytes are not filtered in SQL statements, allowing remote attackers to execute arbitrary SQL via a crafted query. Impact is remote, with network access and high severity in typical assessments. ...

CVE-2015-7503

CVE-2015-7503 affects Zend Framework and Zend Crypt RSA public-key encryption. Zend Framework 2.x before 2.4.9 and 2.5.x before 2.5.2 used OPENSSL_PKCS1_PADDING (PKCS#1 v1.5) in Zend\Crypt\PublicKey\Rsa::encrypt(), enabling a Bleichenbacher-style attack to recover the RSA private key. Exploitatio...

CVE-2015-1786

CVE-2015-1786 : A CSRF vulnerability in Zend Framework 2.3.x (Zend/Validator/Csrf) before 2.3.6 arises from handling of token identifiers that can be null or malformed. This could allow an attacker to forge requests and perform unauthorized actions on behalf of a user. Affected software: Zend Fra...

CVE-2015-1555

Zend Framework 2.2.x prior to 2.2.9 and 2.3.x prior to 2.3.4 are vulnerable in Zend\Session/SessionManager to a session validation bypass that allows remote attackers to create valid sessions without session validators. Root cause: improper session validation logic in SessionManager. Impact: pote...