zend

Top products

The 15 most recently published vulnerabilities affecting zend.

• CVE-2025-32352A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords stored as MD5 hashes that can be interp...4.8Apr 5, 2025
• CVE-2021-47667An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters...10.0Apr 5, 2025
• CVE-2020-29312An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and i...9.8Apr 4, 2023
• CVE-2021-27888ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.6.1Mar 2, 2021
• CVE-2021-3007Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __des...9.8Jan 4, 2021
• CVE-2020-8986lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of...9.8Mar 24, 2020
• CVE-2020-8985ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.8.8Mar 24, 2020
• CVE-2020-8984lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.7.5Mar 24, 2020
• CVE-2014-8089SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL comman...9.8Feb 17, 2020
• CVE-2015-3154CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct...6.1Jan 27, 2020
• CVE-2012-4451Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\P...6.1Jan 3, 2020
• CVE-2014-4913ZF2014-03 has a potential cross site scripting vector in multiple view helpers6.1Dec 15, 2019
• CVE-2011-1939SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.9.8Nov 26, 2019
• CVE-2015-0270Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.9.8Oct 25, 2019
• CVE-2018-1000841Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of t...6.1Dec 20, 2018