Zend Framework vulnerabilities
6 known CVE vulnerabilities in Zend Framework, translated and rated.
- CVE-2020-29312Critical
An issue found in Zend Framework v.3.1.3 and before allows a remote attacker to execute arbitrary code via the unserialize function. However, this has been disputed by third parties as incomplete and incorrect, and the framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
- CVE-2014-4914Critical
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, allowing remote attackers to conduct SQL injection attacks via unspecified vectors.
- CVE-2015-1555Critical
Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9 and 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.
- CVE-2016-6233Critical
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.19 may allow remote attackers to conduct SQL injection attacks via vectors related to the use of the character pattern [\w]* in a regular expression.
- CVE-2016-4861Critical
The (1) order and (2) group methods in Zend_Db_Select in Zend Framework before version 1.12.20 may allow remote attackers to conduct SQL injection attacks due to failure to remove comments from an SQL statement before validation.
- CVE-2015-7695Critical
The PDO adapters in Zend Framework before 1.12.16 do not filter null bytes in SQL statements, allowing remote attackers to execute arbitrary SQL commands via a crafted query.