| Package | Affected versions | Patched versions |
|---|---|---|
| zendframework/zendframework | ≥ 2.0.0, < 2.0.1 | 2.0.1 |
Zend\Debug, Zend\Feed\PubSubHubbub, Zend\Log\Formatter\Xml, Zend\Tag\Cloud\Decorator, Zend\Uri, Zend\View\Helper\HeadStyle, Zend\View\Helper\Navigation\Sitemap, and Zend\View\Helper\Placeholder\Container\AbstractStandalone were not using Zend\Escaper when escaping HTML, HTML attributes, and/or URLs. While most were performing some escaping, because they were not using context-appropriate escaping mechanisms, they could potentially be exploited to perform Cross Site Scripting (XSS) attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free