CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 07/06/2024 |
| GHSA-x2f4-8wxf-w3vf | 高危8.8 | ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations | 07/06/2024 |
| GHSA-qc7w-4567-84wv | 严重9.8 | Zendframework vulnerable to XXE/XEE attacks | 07/06/2024 |
| GHSA-xg9w-r469-m455 | 高危7.4 | ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities | 07/06/2024 |
| GHSA-62f6-h68r-3jpw | 中危6.5 | Zendframework session validation vulnerability | 07/06/2024 |
| GHSA-jq87-2wxp-8349 | 高危7.5 | ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc` | 07/06/2024 |
| GHSA-8q77-cv62-jj38 | 中危6.1 | Zendframework has potential Cross-site Scripting vector in multiple view helpers | 07/06/2024 |
| GHSA-xffp-6w68-4775 | 高危7.5 | Zendframework Remote Address Spoofing Vector in `Zend\Http\PhpEnvironment\RemoteAddress` | 07/06/2024 |
| CVE-2021-3007 | 严重9.8 | Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maint | 04/01/2021 |
| CVE-2014-8089 | 严重9.8 | SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte. | 17/02/2020 |
| CVE-2015-3154 | 中危6.1 | CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email. | 27/01/2020 |
| CVE-2015-0270 | 严重9.8 | Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter. | 25/10/2019 |
| CVE-2015-7503 | 高危7.5 | Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key. | 10/10/2017 |
| CVE-2015-1786 | 高危8.8 | Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers. | 08/06/2017 |
| CVE-2016-6233 | 严重9.8 | The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression. | 17/02/2017 |
| CVE-2016-4861 | 严重9.8 | The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation. | 17/02/2017 |